Payouts King Tor Onion Leak Site DNS or Network Access
Detects network, proxy, or DNS activity associated with .onion pseudo-top-level domains, which are typically used for Tor anonymity services. The rule distinguishes between generic access to the Tor network and specific high-confidence interactions with known malicious onion addresses associated with payout or extortion sites.
Splunk (SPL)
