https://blogs.infoblox.com/threat-intelligence/dns-early-detection-breaking-the-coral-raider-kill-chain/