index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationhostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationhostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationhostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationhostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationhostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationhostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationhostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationhostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationhostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationhostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationhostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationhostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationhostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationhostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationhostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationhostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationhostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationhostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationhostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationhostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationhostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationhostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationhostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationhostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationhostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationhostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationhostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationhostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationhostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationhostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationhostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationhostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationhostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationhostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationhostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationhostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationhostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationhostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationhostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationhostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationhostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationhostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationhostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationhostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationhostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationhostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationhostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcentdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcentdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcentdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcentdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcentdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcentdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcentdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcentdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcentdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcentdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcentdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcentdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcentdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcentdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcentdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcentdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcentdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcentdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcentdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcentdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcentdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcentdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcentdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcentdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcentdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcentdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcentdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcentdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcentdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcentdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcentdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcentdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcentdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcentdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcentdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcentdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcentdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcentdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcentdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcentdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcentdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcentdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcentdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcentdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcentdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcentdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcentdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR sourcehostname CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR sourcehostname CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR sourcehostname CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR sourcehostname CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR sourcehostname CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR sourcehostname CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR sourcehostname CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR sourcehostname CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR sourcehostname CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR sourcehostname CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR sourcehostname CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR sourcehostname CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR sourcehostname CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR sourcehostname CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR sourcehostname CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR sourcehostname CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR sourcehostname CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR sourcehostname CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR sourcehostname CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR sourcehostname CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR sourcehostname CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR sourcehostname CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR sourcehostname CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR sourcehostname CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR sourcehostname CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR sourcehostname CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR sourcehostname CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR sourcehostname CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR sourcehostname CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR sourcehostname CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR sourcehostname CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR sourcehostname CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR sourcehostname CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR sourcehostname CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR sourcehostname CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR sourcehostname CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR sourcehostname CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR sourcehostname CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR sourcehostname CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR sourcehostname CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR sourcehostname CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR sourcehostname CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR sourcehostname CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR sourcehostname CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR sourcehostname CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR sourcehostname CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR sourcehostname CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR destinationntdomain CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR destinationntdomain CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR destinationntdomain CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR destinationntdomain CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR destinationntdomain CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR destinationntdomain CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR destinationntdomain CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR destinationntdomain CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR destinationntdomain CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR destinationntdomain CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR destinationntdomain CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR destinationntdomain CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR destinationntdomain CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR destinationntdomain CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR destinationntdomain CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR destinationntdomain CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR destinationntdomain CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR destinationntdomain CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR destinationntdomain CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR destinationntdomain CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR destinationntdomain CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR destinationntdomain CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR destinationntdomain CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR destinationntdomain CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR destinationntdomain CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR destinationntdomain CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR destinationntdomain CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR destinationntdomain CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR destinationntdomain CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR destinationntdomain CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR destinationntdomain CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR destinationntdomain CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR destinationntdomain CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR destinationntdomain CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR destinationntdomain CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR destinationntdomain CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR destinationntdomain CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR destinationntdomain CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR destinationntdomain CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR destinationntdomain CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR destinationntdomain CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR destinationntdomain CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR destinationntdomain CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR destinationntdomain CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR destinationntdomain CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR destinationntdomain CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR destinationntdomain CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion" OR requesturl CONTAINS "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion" OR requesturl CONTAINS "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion" OR requesturl CONTAINS "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion" OR requesturl CONTAINS "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion" OR requesturl CONTAINS "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion" OR requesturl CONTAINS "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion" OR requesturl CONTAINS "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion" OR requesturl CONTAINS "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion" OR requesturl CONTAINS "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion" OR requesturl CONTAINS "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion" OR requesturl CONTAINS "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion" OR requesturl CONTAINS "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion" OR requesturl CONTAINS "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion" OR requesturl CONTAINS "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion" OR requesturl CONTAINS "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion" OR requesturl CONTAINS "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion" OR requesturl CONTAINS "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion" OR requesturl CONTAINS "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion" OR requesturl CONTAINS "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion" OR requesturl CONTAINS "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion" OR requesturl CONTAINS "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion" OR requesturl CONTAINS "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion" OR requesturl CONTAINS "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion" OR requesturl CONTAINS "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion" OR requesturl CONTAINS "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion" OR requesturl CONTAINS "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion" OR requesturl CONTAINS "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion" OR requesturl CONTAINS "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion" OR requesturl CONTAINS "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion" OR requesturl CONTAINS "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion" OR requesturl CONTAINS "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion" OR requesturl CONTAINS "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion" OR requesturl CONTAINS "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion" OR requesturl CONTAINS "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion" OR requesturl CONTAINS "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion" OR requesturl CONTAINS "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion" OR requesturl CONTAINS "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion" OR requesturl CONTAINS "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion" OR requesturl CONTAINS "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion" OR requesturl CONTAINS "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion" OR requesturl CONTAINS "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion" OR requesturl CONTAINS "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion" OR requesturl CONTAINS "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion" OR requesturl CONTAINS "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion" OR requesturl CONTAINS "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion" OR requesturl CONTAINS "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion" OR requesturl CONTAINS "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationhostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationhostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationhostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationhostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationhostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationhostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationhostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationhostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationhostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcentdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcentdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcentdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcentdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcentdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcentdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcentdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcentdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcentdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR sourcehostname CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR sourcehostname CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR sourcehostname CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR sourcehostname CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR sourcehostname CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR sourcehostname CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR sourcehostname CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR sourcehostname CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR sourcehostname CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR destinationntdomain CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR destinationntdomain CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR destinationntdomain CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR destinationntdomain CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR destinationntdomain CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR destinationntdomain CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR destinationntdomain CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR destinationntdomain CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR destinationntdomain CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion" OR requesturl CONTAINS "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion" OR requesturl CONTAINS "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion" OR requesturl CONTAINS "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion" OR requesturl CONTAINS "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion" OR requesturl CONTAINS "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion" OR requesturl CONTAINS "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion" OR requesturl CONTAINS "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion" OR requesturl CONTAINS "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion" OR requesturl CONTAINS "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6","05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65")
