""ET DNS Reply Sinkhole - Georgia Tech (2)""

SID: 2016423

Revision: 7

Class Type: trojan-activity

Metadata: created_at 2013_02_16, updated_at 2022_07_13

Reference:

• Link

Protocol: udp

Source Network: any

Source Port: 53

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

• Value: "|00 01 00 01|"

• Value: "|00 04 32 3e 0c 67|"

Within: 6

PCRE:

Special Options:

source