Known Bulletproof Hosting TLD Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects DNS queries for top-level domains (TLDs) commonly associated with bulletproof hosting services. Specifically, it looks for queries ending in .ru, .cn, .tk, .ml, .ga, .cf, or .gq. A threshold of 20 queries within 60 seconds from the same source IP will trigger an alert.