alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Andorra"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ad\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - United Arab Emirates"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ae\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Afghanistan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.af\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Antigua/Barbuda"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ag\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Anguilla"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ai\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Albania"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.al\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Armenia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.am\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Antilles"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.an\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Angola"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ao\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Antarctica"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.aq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Argentina"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ar\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - American Samoa"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.as\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Australia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.au\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Austria"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.at\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Aruba"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.aw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Azerbaijan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.az\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bosnia/Herzegovina"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ba\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Barbados"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bangladesh"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bd\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Belgium"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.be\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Burkina Faso"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bulgaria"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bahrain"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Burundi"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Benin"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bermuda"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Brunei Darussalam"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bolivia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Brazil"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.br\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bahamas"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bs\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bhutan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Bouvet Island"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Botswana"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Belarus"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.by\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Belize"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.bz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Canada"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ca\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cocos Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Central African Republic"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Congo"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Switzerland"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ch\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Ivory Coast"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ci\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cook Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ck\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Chile"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cameroon"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - China"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Colombia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.co\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Costa Rica"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Czech Republic"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cs\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cuba"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cape Verde"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Christmas Island"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cx\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cyprus"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Czech Republic"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.cz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Djibouti"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Denmark"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Dominica"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Dominican Republic"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.do\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Algeria"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.dz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Ecuador"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ec\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Estonia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ee\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Egypt"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.eg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Western Sahara"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.eh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Eritrea"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.er\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Spain"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.es\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Ethiopia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.et\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Finland"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Fiji"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Falkland Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Micronesia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Faroe Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - France"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - France"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.fx\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Gabon"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ga\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Great Britain"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Grenada"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gd\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Georgia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ge\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - French Guiana"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Ghana"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Gibraltar"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Greenland"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Gambia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Guinea"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Guadeloupe"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Equatorial Guinea"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Greece"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Georgia/Sandwich Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gs\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Guatemala"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Guam"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Guinea-Bissau"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Guyana"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.gy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Hong Kong"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Heard/McDonald Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Honduras"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Croatia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Haiti"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ht\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Hungary"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.hu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Indonesia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.id\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Israel"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.il\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - India"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.in\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - British Indian Ocean Territory"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.io\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Iraq"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.iq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Iran"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ir\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Iceland"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.is\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Italy"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.it\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Jamaica"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.jm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Jordan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.jo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Japan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.jp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Kenya"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ke\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Kyrgyzstan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cambodia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Kiribati"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ki\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Comoros"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.km\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Saint Kitts/Nevis"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - North Korea"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Kuwait"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Cayman Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ky\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Kazakhstan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.kz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Laos"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.la\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Lebanon"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Saint Lucia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Liechtenstein"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.li\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Sri Lanka"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Liberia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Lesotho"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ls\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Lithuania"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Luxembourg"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Latvia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.lv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Libya"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ly\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Morocco"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ma\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Monaco"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Moldova"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.md\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Madagascar"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Marshall Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Macedonia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mali"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ml\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Myanmar"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mongolia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Macau"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mo\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Northern Mariana Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Martinique"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mq\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mauritania"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Montserrat"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ms\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Malta"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mauritius"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Maldives"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Malawi"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Malaysia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.my\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mexico"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mx\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mozambique"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Namibia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.na\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - New Caledonia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Niger"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ne\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Norfolk Island"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Nigeria"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ng\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Nicaragua"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ni\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Netherlands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Norway"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.no\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Nepal"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.np\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Nauru"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Neutral Zone"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Niue"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - New Zealand"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.nz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Oman"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\\.om\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Panama"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pa\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Peru"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pe\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - French Polynesia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Papua New Guinea"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Philippines"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ph\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Pakistan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Poland"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - St. Pierre/Miquelon"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Pitcairn"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Puerto Rico"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Palestine"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ps\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Portugal"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Palau"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.pw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Paraguay"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.py\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Qatar"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.qa\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Reunion"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.re\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Romania"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ro\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Russian Federation"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ru\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Rwanda"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.rw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Saudi Arabia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sa\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Solomon Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sb\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Seychelles"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Sudan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sd\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Sweden"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.se\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Singapore"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - St. Helena"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sh\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Slovenia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.si\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Svalbard/Jan Mayen Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Slovak Republic"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Sierra Leone"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sl\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - San Marino"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Senegal"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Somalia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.so\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Suriname"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Sao Tome/Principe"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.st\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - USSR (Former)"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.su\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - El Salvador"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Syria"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Swaziland"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.sz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Turks/Caicos Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Chad"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.td\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - French Southern Territories"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Togo"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Thailand"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.th\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Tajikistan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tj\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Tokelau"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Turkmenistan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Tunisia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - East Timor"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tp\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Turkey"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Trinidad/Tobago"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Tuvalu"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tv\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Taiwan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Tanzania"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.tz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
# alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - United Kingdom"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.uk\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Ukraine"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ua\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Uganda"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ug\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - US Minor Outlying Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.um\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Uruguay"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.uy\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Uzbekistan"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.uz\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Vatican City"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.va\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Saint Vincent/Grenadines"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vc\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Venezuela"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ve\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - British Virgin Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vg\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - US Virgin Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vi\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Vietnam"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vn\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Vanuatu"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.vu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Wallis/Futuna Islands"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.wf\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Samoa"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ws\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Yemen"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.ye\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Mayotte"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.yt\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Yugoslavia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.yu\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - South Africa"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.za\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Zambia"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.zm\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Zaire"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.zr\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)
alert tcp $HOME_NET any -> any 80 (msg:"UNUSUAL COUNTRY - Zimbabwe"; flow:established; pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.zw\r\n)/"; reference:url,www.iana.org/cctld/cctld-whois.htm;)