Exploit Kit Purchase Site Access Detected
This rule detects access to known exploit kit purchase or dark web marketplace sites by inspecting HTTP host headers for specific domain patterns. The rule triggers an alert if a client on the home network attempts to connect to any of the listed domains, which are associated with exploit kit sales or underground forums.
Suricata
