""ET DNS Reply Sinkhole - 106.187.96.49 blacklistthisdomain.com""
SID: 2016591
Revision: 6
Class Type: trojan-activity
Metadata: created_at 2013_03_19, updated_at 2014_08_26, reviewed_at 2024_03_25
Reference:
Protocol: udp
Source Network: any
Source Port: 53
Destination Network: $HOME_NET
Destination Port: any
Flow:
Contents:
-
Value: "|00 01 00 01|"
-
Value: "|00 04 6a bb 60 31|"
Within: 6
PCRE:
Special Options: