##########################################
#
# Social Network Snort Rules
#
# Copyright 2005-2006 Cory Bys
# All Rights Reserved
# Particle.Bored@kgb.to
#
# This rule set is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This rule set is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# Thanks to Matt Jonkman for the optimization tips
#
# Last Update 12 September 2006
#
##########################################
#
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - 8minuteDating"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(8minutedating.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - A Greater Date"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(agreaterdate.com|ajewishdatingsite.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Adoppt"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(adoppt.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - AfroRomance"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(afroromance.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - AIM Pages"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(aimpages.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - AmericanSingles"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(americansingles.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Backwash"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(social.backwash.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Bebo"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(bebo.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Blogpod"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(blogpod.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Blue Dot"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(blogspot.com|bluedot.us)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - bobojam"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(bobojam.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - BuddyBridge"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(buddybridge.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - BuddyZoo"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(buddyzoo.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - BusyThumbs"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(busythumbs.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Buzznet"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(buzznet.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - BUZZSession.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(buzzsession.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - CampusBug"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(campusbug.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Catster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(catster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Cherish"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(cherish.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ChosenNet"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(chosennet.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Christianster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(christianster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ChristiansTogether"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(christianstogether.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Cingo"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(cingo.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ClubMom"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(clubmom.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - CollectiveX"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(collectivex.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - CollegeLuv"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(collegeluv.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Communities"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(communities.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Community Connect"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(asianavenue.com|blackplanet.com|migente.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ConnectU"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(connectu.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Country Singles"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(countrysinglesonline.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Craigslist"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(craigslist.org)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Cupid.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(cupid.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Cyworld"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(cyworld.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Date.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(date.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Dating Jewish Singles"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(datingjewishsingles.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Dating.dk"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(dating.dk)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Dogster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(dogster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Dude Check This Out"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(dudecheckthisout.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Earthcomber"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(earthcomber.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - EasyDate"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(datetheuk.com|datingbridge.com|myukdate.com|ukgaylife.com|youcangetme.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - eFriendsnet"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(efriendsnet.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - eHarmony"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(eharmony.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Elhood"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(elhood.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - eLifeList"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(elifelist.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Eons"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(eons.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Equally Yoked"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(equallyyoked.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - eTwine"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(etwine.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Everyones Connected"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(everyonesconnected.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Evite"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(evite.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Expressions"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(my-expressions.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Facebook"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(facebook.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Faceparty"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(faceparty.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Famster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(famster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Faqqly"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(faqqly.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Findapix"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(findapix.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Flickr"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(flickr.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Frappr"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(frappr.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Friend MAP"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendmap.jp)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Friend Surfer"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendsurfer.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - FriendFinder"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(amigos.com|asiafriendfinder.com|friendfinder.com|friendfinderinc.com|germanfriendfinder.com|indianfriendfinder.com|jewishfriendfinder.com|passion.com|seniorfriendfinder.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Friends Reunited"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(findakiwi.co.|findakiwidate.co.|friendsreunited.co.|friendsreunitedconnections.co.|friendsreuniteddating.co.|friendsreunitedjobs.co.|genesreunited.co.|schoolfriends.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - friendsbay"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendsbay.de)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Friendset"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendset.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Friendster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Friendzy"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendzy.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Funchain"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(funchain.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Fuzzster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(fuzzster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Gay Christian Dating"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(gaychristiandating.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Gay Jewish Dating"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(gayjewishdating.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Gay Military Men"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(gaymilitarym4m.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - GeekDinner"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(geekdinner.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Gorilla Exchange"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(gorillaexchange.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Gruuve"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(gruuve.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - HeiYou"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(heiyou.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - hi5"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(hi5.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Hookup"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(hookup.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - hotsaints"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(hotsaints.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Huminity"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(huminity.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - HurryDate"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(hurrydate.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ifriends"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(ifriends.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Imbee"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(imbee.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - imeem"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(imeem.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - It's Just Coffee"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(itsjustcoffee.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - JDate"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(jdate.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Jewish Matchmaker"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(jewishmatchmaker.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Jewish Personals"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(relationshipnetwork.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - JewishCafe"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(jewishcafe.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - JewishLoveMatch"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(jewishlovematch.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - JMatch"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(jmatch.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - JournURL"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(journurl.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - KnowMates"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(knowmates.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Lavalife"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(lavalife.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LDS LinkUp"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(ldslinkup.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LDS Singles Mingle"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(ldsmingle.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LDS Singles Network"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(ldssinglesnetwork.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LDS Singles SingleSaints"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(singlesaints.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LianQu"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(lianqu.com.cn)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LinkedIn"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(linkedin.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - linkyourfriends"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(linkyourfriends.co.uk)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LiveJournal"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(livejournal.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Living Directory"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(livingdirectory.org)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Lokalisten"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(lokalisten.de)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Lost Cherry"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(lostcherry.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Love at AOL"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(love.com|personals.aol.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - LunarStorm"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(lunarstorm.co.uk)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - M4M Seniors"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(m4mseniors.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Magoori"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(magoori.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Match.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(match.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Mature Dating"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(maturedating.org)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - meetic"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(meetic.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MEETin"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(meetin.org)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MeetUp"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(meetup.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MegaFriends"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(megafriends.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MeineFreunde"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendity.de|meinefreunde.de)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Minti"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(minti.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MixedNutz.net"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mixednutz.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MixerMixer"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mixermixer.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Mixi"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mixi.jp)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Mobido"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mobido.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Mog"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mog.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Mooble"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mooble.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Mosuki"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mosuki.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - mo'time"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(motime.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Multiply"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(multiply.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MuslimSpace"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(muslimspace.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MyCountryMatch"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mycountrymatch.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MyEMatch"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(myematch.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MyKindaPlace Blog"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mykindablog.co.)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MyShoots"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(myshoots.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - MySpace"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(myspace.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Neighborwork.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(neighborwork.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - NetFriendships"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(netfriendships.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Netparty"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(netparty.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Neurofriends"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(neurofriends.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - new-in-town"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(new-in-town.de)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - NextCat"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(nextcat.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Nioki.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(nioki.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Orkut"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(orkut.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Others Online"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(othersonline.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Overweight Date"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(overweightdate.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Palbook"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(palbook.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - PalJunction"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(paljunction.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Passions Network"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(passionsnetwork.com|w4wpassions.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Peeps Nation"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(peepsnation.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - PeopleAggregator"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(peopleaggregator.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Persian Blog"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(persianblog.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Playtxt"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(playtext.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Plazes"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(plazes.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ProfileHeaven"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(profileheaven.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ProfileHelper"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(profilehelper.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Rate or Date"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(rateordate.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Relationship Exchange"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(relationshipexchange.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Robot Co-op"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(43friends.com|43things.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Rogue Connect"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(rogueconnect.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - saywhatz"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(saywhatz.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Senior Dating Exchange"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(seniordatingexchange.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - SeniorsCircle"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(seniorscircle.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Single Jew"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(singlejew.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Single Seniors"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(singleseniors.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - SmallPlanet"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(smallplanet.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - SmutVibe"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(smutvibe.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Sneakerplay"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(sneakerplay.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Social Paradise"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(friendoo.com|socialparadise.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - SocialGrid"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(socialgrid.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Socialight"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(socialight.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Spicy Senior Singles"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(spicy-senior-singles.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - SQUIBY"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(squiby.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Swappster"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(swappster.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - TagWorld"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(tagworld.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Takkle"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(takkle.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Textamerica"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(textamerica.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - The Impersonals"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(impersonals.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - The Lunch Club"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(thelunchclub.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Tickle"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(emode.com|tickle.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - ticqle"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(ticqle.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Tribe"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(tribe.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - True"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(true.com|truebeginnings.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - uDate.com"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(udate.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Univillage"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(univillage.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Upcoming"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(upcoming.org)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Urban Traditional"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(urbantraditional.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Utherverse"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(utherverse.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Vampire Freaks"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(vampirefreaks.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - VeggieDate"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(veggiedate.org)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Veoh"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(veoh.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Wallop"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(mywallop.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - WAYN"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(wayn.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - webdate"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(webdate.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - WeeWorld"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(saw-you.com|weeworld.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - WhoAt"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(whoat.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Windows Live"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(spaces.live.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Wow Friends"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(wowfriends.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Xanga"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(xanga.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Yahoo 360"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(360.yahoo.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Yahoo Personals"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(personals.yahoo.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - YeeYoo"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(yeeyoo.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Your Ideal Date"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(yid.com)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Zdarmanet"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(zdarmanet.net)\r\n/";)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"SOCIAL NET - Zorpia"; flow:established; content:"Host\:"; pcre:"/(Host\:)(\s[a-zA-Z0-9.-]+\.|\s)(zorpia.com)\r\n/";)