Free Hosting Service Used for Attack Infrastructure
This rule detects HTTP requests where the 'Host' header contains patterns indicative of free hosting services (000webhost, infinityfree, byethost). These services are often abused by attackers to host malicious infrastructure due to their low cost and ease of setup. The rule specifically looks for these patterns in HTTP traffic flowing from the home network to any destination.
Suricata
