""ET DNS Reply Sinkhole - 106.187.96.49 blacklistthisdomain.com""

SID: 2016591

Revision: 6

Class Type: trojan-activity

Metadata: created_at 2013_03_19, updated_at 2014_08_26, reviewed_at 2024_03_25

Reference:

Protocol: udp

Source Network: any

Source Port: 53

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

  • Value: "|00 01 00 01|"

  • Value: "|00 04 6a bb 60 31|"

Within: 6

PCRE:

Special Options:

source