Dark Web Onion Domain Lookup Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network and the dark web. Such queries indicate potential attempts to access dark web resources, which could be a policy violation or an indicator of malicious activity.