##########################################
#
# Domain Country Code Snort Rules
#
# Copyright 2005-2008 Cory Bys
# All Rights Reserved
# Particle.Bored@kgb.to
#
# This rule set is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This rule set is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# Thanks to Matt Jonkman for the optimization tips
#
# Last Update 23 January 2008
#
##########################################
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Afghanistan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.af\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870000;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Aland Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ax\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870235;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Albania"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.al\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870001;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Algeria"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870002;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - American Samoa"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.as\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870003;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Andorra"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ad\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870004;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Angola"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ao\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870005;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Anguilla"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ai\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870006;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Antarctica"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.aq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870007;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Antigua/Barbuda"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ag\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870008;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Antilles"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.an\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870009;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Argentina"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ar\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870010;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Armenia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.am\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870011;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Aruba"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.aw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870012;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Ascension Island"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ac\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870234;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Australia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.au\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870013;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Austria"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.at\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870014;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Azerbaijan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.az\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870015;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bahamas"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bs\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870016;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bahrain"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870017;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bangladesh"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bd\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870018;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Barbados"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870019;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Belarus"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.by\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870020;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Belgium"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.be\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870021;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Benin"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870022;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bermuda"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870023;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bhutan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870024;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bolivia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870025;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bosnia/Herzegovina"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ba\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870026;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Botswana"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870027;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bouvet Island"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870028;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Brazil"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.br\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870028;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - British Indian Ocean Territory"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.io\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870029;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - British Virgin Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870030;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Brunei Darussalam"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870031;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Bulgaria"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870032;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Burkina Faso"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870033;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Burundi"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870034;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cambodia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870035;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cameroon"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870036;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Canada"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ca\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870037;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cape Verde"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870038;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cayman Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ky\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870039;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Central African Republic"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870040;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Chad"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.td\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870041;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Chile"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870042;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - China"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870043;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Christmas Island"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cx\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870044;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cocos/Keeling Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870236;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Colombia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.co\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870045;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Comoros"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.km\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870046;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Congo"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870047;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cook Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ck\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870048;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Costa Rica"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870049;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Croatia/Hrvatska"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870050;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cuba"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870051;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Cyprus"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870052;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Czech Republic"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870054;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Denmark"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870055;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Djibouti"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870056;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Dominica"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870057;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Dominican Republic"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.do\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870058;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - East Timor"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870059;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Ecuador"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ec\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870060;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Egypt"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.eg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870061;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - El Salvador"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870062;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Equatorial Guinea"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870063;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Eritrea"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.er\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870064;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Estonia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ee\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870065;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Ethiopia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.et\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870066;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - European Union"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.eu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870237;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Falkland Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870067;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Faroe Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870068;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Federated States of Micronesia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870238;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Fiji"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870069;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Finland"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870070;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - France"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870071;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - French Guiana"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870073;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - French Polynesia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870074;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - French Southern Territories"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870075;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Gabon"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ga\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870076;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Gambia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870077;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Georgia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ge\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870078;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Georgia/Sandwich Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gs\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870079;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Ghana"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870080;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Gibraltar"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870081;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Greece"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870083;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Greenland"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870084;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Grenada"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gd\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870085;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guadeloupe"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870086;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guam"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870087;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guatemala"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870088;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guernsey"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870238;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guinea"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870089;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guinea-Bissau"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870090;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Guyana"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870091;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Haiti"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ht\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870092;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Heard/McDonald Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870093;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Honduras"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870094;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Hong Kong"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870095;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Hungary"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870096;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Iceland"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.is\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870097;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - India"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.in\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870098;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Indonesia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.id\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870099;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Iran"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ir\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870100;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Iraq"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.iq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870101;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Israel"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.il\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870102;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Italy"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.it\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870103;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Ivory Coast"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ci\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870104;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Jamaica"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.jm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870105;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Japan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.jp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870106;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Jersey"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.je\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870239;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Jordan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.jo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870107;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Kazakhstan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870108;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Kenya"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ke\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870109;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Kiribati"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ki\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870110;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Kuwait"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870111;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Kyrgyzstan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870112;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Laos"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.la\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870113;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Latvia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870114;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Lebanon"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870115;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Lesotho"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ls\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870116;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Liberia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870117;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Libya"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ly\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870118;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Liechtenstein"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.li\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870119;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Lithuania"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870120;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Luxembourg"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870121;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Macao"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870122;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Macedonia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870123;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Madagascar"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870124;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Malawi"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870125;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Malaysia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.my\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870126;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Maldives"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870127;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mali"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ml\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870128;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Malta"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870129;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Marshall Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870130;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Martinique"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870131;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mauritania"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870132;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mauritius"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870133;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mayotte"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.yt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870134;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mexico"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mx\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870135;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Moldova"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.md\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870136;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Monaco"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870137;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mongolia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870138;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Montenegro"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.me\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870240;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Montserrat"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ms\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870139;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Morocco"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ma\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870140;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Mozambique"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870141;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Myanmar"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870142;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Namibia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.na\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870143;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Nauru"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870144;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Nepal"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.np\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870145;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Netherlands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870146;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Neutral Zone"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870147;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - New Caledonia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870148;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - New Zealand"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870149;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Nicaragua"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ni\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870150;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Niger"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ne\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870151;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Nigeria"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ng\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870152;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Niue"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870153;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Norfolk Island"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870154;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - North Korea"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870155;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Northern Mariana Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870156;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Norway"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.no\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870157;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Oman"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\\.om\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870158;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Pakistan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870159;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Palau"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870160;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Palestine"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ps\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870161;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Panama"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pa\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870162;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Papua New Guinea"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870163;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Paraguay"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.py\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870164;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Peru"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pe\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870165;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Philippines"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ph\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870166;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Pitcairn"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870167;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Poland"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870168;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Portugal"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870169;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Puerto Rico"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870170;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Qatar"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.qa\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870171;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Reunion"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.re\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870172;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Romania"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ro\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870173;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Russian Federation"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ru\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870174;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Rwanda"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.rw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870175;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saint Kitts/Nevis"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870176;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saint Lucia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870177;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saint Martin"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870241;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saint Vincent/Grenadines"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870178;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Samoa"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ws\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870179;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - San Marino"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870180;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Sao Tome/Principe"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.st\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870181;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saudi Arabia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sa\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870182;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Senegal"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870183;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Serbia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.rs\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870242;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Seychelles"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870184;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Sierra Leone"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870185;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Singapore"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870186;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Slovak Republic"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870187;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Slovenia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.si\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870188;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Solomon Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870189;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Somalia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.so\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870190;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - South Africa"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.za\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870191;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Spain"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.es\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870192;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Sri Lanka"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870193;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saint Helena"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870194;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Saint Pierre/Miquelon"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870195;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Sudan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sd\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870196;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Suriname"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870197;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Svalbard/Jan Mayen Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870198;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Swaziland"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870199;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Sweden"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.se\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870200;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Switzerland"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ch\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870201;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Syria"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870202;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Taiwan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870203;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Tajikistan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870204;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Tanzania"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870205;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Thailand"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.th\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870206;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Togo"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870207;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Tokelau"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870208;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Trinidad/Tobago"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870209;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Tunisia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870210;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Turkey"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870211;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Turkmenistan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870212;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Turks/Caicos Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870213;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Uganda"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ug\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870214;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Ukraine"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ua\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870215;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - United Arab Emirates"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ae\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870216;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - United Kingdom"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870082;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - United Kingdom"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.uk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870217;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Uruguay"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.uy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870218;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - US Minor Outlying Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.um\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870219;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - US Virgin Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870220;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - USSR (Former)"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.su\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870221;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Uzbekistan"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.uz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870222;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Vanuatu"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870223;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Vatican City"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.va\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870224;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Venezuela"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ve\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870225;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Vietnam"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870226;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Wallis/Futuna Islands"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.wf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870227;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Western Sahara"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.eh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870228;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Yemen"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ye\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870229;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Yugoslavia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.yu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870230;)
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Zaire"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.zr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870231;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Zambia"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.zm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870232;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"UNUSUAL COUNTRY - Zimbabwe"; flow:established; content:"Host\:"; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.zw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm; sid: 1870233;)