index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dns-beast.com" OR destinationhostname CONTAINS "don-dns.com" OR destinationhostname CONTAINS "die-dns.com" OR destinationhostname CONTAINS "hit-mee.com" OR destinationhostname CONTAINS "noname-domain.com" OR destinationhostname CONTAINS "don-die.com" OR destinationhostname CONTAINS "old-big.com" OR destinationhostname CONTAINS "you-rabbit.com" OR destinationhostname CONTAINS "web-lox.com" OR destinationhostname CONTAINS "tchk-1.com" OR destinationhostname CONTAINS "ht-specialize.xyz" OR destinationhostname CONTAINS "ht-input.cfd" OR destinationhostname CONTAINS "ht-queen.cfd" OR destinationhostname CONTAINS "ht-dilemma.xyz" OR destinationhostname CONTAINS "io-strength.cfd" OR destinationhostname CONTAINS "fbs-university.xyz" OR destinationhostname CONTAINS "io-previous.xyz" OR destinationhostname CONTAINS "io-band.cfd" OR destinationhostname CONTAINS "can-nothing.cfd" OR destinationhostname CONTAINS "scope-chat.xyz" OR destinationhostname CONTAINS "stroke-chat.click" OR destinationhostname CONTAINS "icl-surprise.xyz" OR destinationhostname CONTAINS "new-high.click" OR destinationhostname CONTAINS "shrimp-clock.click" OR destinationhostname CONTAINS "oo-knowledge.xyz" OR destinationhostname CONTAINS "oo-station.xyz" OR destinationhostname CONTAINS "oo-blue.click" OR destinationhostname CONTAINS "oo-strategy.xyz" OR destinationhostname CONTAINS "oo-clearly.click" OR destinationhostname CONTAINS "economy-h.xyz" OR destinationhostname CONTAINS "medical-h.click" OR destinationhostname CONTAINS "hospital-h.xyz" OR destinationhostname CONTAINS "church-h.click" OR destinationhostname CONTAINS "close-h.xyz" OR destinationhostname CONTAINS "thousand-h.click" OR destinationhostname CONTAINS "risk-h.xyz" OR destinationhostname CONTAINS "current-h.click" OR destinationhostname CONTAINS "fire-h.xyz" OR destinationhostname CONTAINS "future-h.click" OR destinationhostname CONTAINS "moment-are.xyz" OR destinationhostname CONTAINS "himself-are.click" OR destinationhostname CONTAINS "air-are.xyz" OR destinationhostname CONTAINS "teacher-are.click" OR destinationhostname CONTAINS "force-are.xyz" OR destinationhostname CONTAINS "enough-are.xyz" OR destinationhostname CONTAINS "education-are.click" OR destinationhostname CONTAINS "across-are.xyz" OR destinationhostname CONTAINS "although-are.click" OR destinationhostname CONTAINS "punishment-chat.click" OR destinationhostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dns-beast.com" OR sourcentdomain CONTAINS "don-dns.com" OR sourcentdomain CONTAINS "die-dns.com" OR sourcentdomain CONTAINS "hit-mee.com" OR sourcentdomain CONTAINS "noname-domain.com" OR sourcentdomain CONTAINS "don-die.com" OR sourcentdomain CONTAINS "old-big.com" OR sourcentdomain CONTAINS "you-rabbit.com" OR sourcentdomain CONTAINS "web-lox.com" OR sourcentdomain CONTAINS "tchk-1.com" OR sourcentdomain CONTAINS "ht-specialize.xyz" OR sourcentdomain CONTAINS "ht-input.cfd" OR sourcentdomain CONTAINS "ht-queen.cfd" OR sourcentdomain CONTAINS "ht-dilemma.xyz" OR sourcentdomain CONTAINS "io-strength.cfd" OR sourcentdomain CONTAINS "fbs-university.xyz" OR sourcentdomain CONTAINS "io-previous.xyz" OR sourcentdomain CONTAINS "io-band.cfd" OR sourcentdomain CONTAINS "can-nothing.cfd" OR sourcentdomain CONTAINS "scope-chat.xyz" OR sourcentdomain CONTAINS "stroke-chat.click" OR sourcentdomain CONTAINS "icl-surprise.xyz" OR sourcentdomain CONTAINS "new-high.click" OR sourcentdomain CONTAINS "shrimp-clock.click" OR sourcentdomain CONTAINS "oo-knowledge.xyz" OR sourcentdomain CONTAINS "oo-station.xyz" OR sourcentdomain CONTAINS "oo-blue.click" OR sourcentdomain CONTAINS "oo-strategy.xyz" OR sourcentdomain CONTAINS "oo-clearly.click" OR sourcentdomain CONTAINS "economy-h.xyz" OR sourcentdomain CONTAINS "medical-h.click" OR sourcentdomain CONTAINS "hospital-h.xyz" OR sourcentdomain CONTAINS "church-h.click" OR sourcentdomain CONTAINS "close-h.xyz" OR sourcentdomain CONTAINS "thousand-h.click" OR sourcentdomain CONTAINS "risk-h.xyz" OR sourcentdomain CONTAINS "current-h.click" OR sourcentdomain CONTAINS "fire-h.xyz" OR sourcentdomain CONTAINS "future-h.click" OR sourcentdomain CONTAINS "moment-are.xyz" OR sourcentdomain CONTAINS "himself-are.click" OR sourcentdomain CONTAINS "air-are.xyz" OR sourcentdomain CONTAINS "teacher-are.click" OR sourcentdomain CONTAINS "force-are.xyz" OR sourcentdomain CONTAINS "enough-are.xyz" OR sourcentdomain CONTAINS "education-are.click" OR sourcentdomain CONTAINS "across-are.xyz" OR sourcentdomain CONTAINS "although-are.click" OR sourcentdomain CONTAINS "punishment-chat.click" OR sourcentdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dns-beast.com" OR sourcehostname CONTAINS "don-dns.com" OR sourcehostname CONTAINS "die-dns.com" OR sourcehostname CONTAINS "hit-mee.com" OR sourcehostname CONTAINS "noname-domain.com" OR sourcehostname CONTAINS "don-die.com" OR sourcehostname CONTAINS "old-big.com" OR sourcehostname CONTAINS "you-rabbit.com" OR sourcehostname CONTAINS "web-lox.com" OR sourcehostname CONTAINS "tchk-1.com" OR sourcehostname CONTAINS "ht-specialize.xyz" OR sourcehostname CONTAINS "ht-input.cfd" OR sourcehostname CONTAINS "ht-queen.cfd" OR sourcehostname CONTAINS "ht-dilemma.xyz" OR sourcehostname CONTAINS "io-strength.cfd" OR sourcehostname CONTAINS "fbs-university.xyz" OR sourcehostname CONTAINS "io-previous.xyz" OR sourcehostname CONTAINS "io-band.cfd" OR sourcehostname CONTAINS "can-nothing.cfd" OR sourcehostname CONTAINS "scope-chat.xyz" OR sourcehostname CONTAINS "stroke-chat.click" OR sourcehostname CONTAINS "icl-surprise.xyz" OR sourcehostname CONTAINS "new-high.click" OR sourcehostname CONTAINS "shrimp-clock.click" OR sourcehostname CONTAINS "oo-knowledge.xyz" OR sourcehostname CONTAINS "oo-station.xyz" OR sourcehostname CONTAINS "oo-blue.click" OR sourcehostname CONTAINS "oo-strategy.xyz" OR sourcehostname CONTAINS "oo-clearly.click" OR sourcehostname CONTAINS "economy-h.xyz" OR sourcehostname CONTAINS "medical-h.click" OR sourcehostname CONTAINS "hospital-h.xyz" OR sourcehostname CONTAINS "church-h.click" OR sourcehostname CONTAINS "close-h.xyz" OR sourcehostname CONTAINS "thousand-h.click" OR sourcehostname CONTAINS "risk-h.xyz" OR sourcehostname CONTAINS "current-h.click" OR sourcehostname CONTAINS "fire-h.xyz" OR sourcehostname CONTAINS "future-h.click" OR sourcehostname CONTAINS "moment-are.xyz" OR sourcehostname CONTAINS "himself-are.click" OR sourcehostname CONTAINS "air-are.xyz" OR sourcehostname CONTAINS "teacher-are.click" OR sourcehostname CONTAINS "force-are.xyz" OR sourcehostname CONTAINS "enough-are.xyz" OR sourcehostname CONTAINS "education-are.click" OR sourcehostname CONTAINS "across-are.xyz" OR sourcehostname CONTAINS "although-are.click" OR sourcehostname CONTAINS "punishment-chat.click" OR sourcehostname CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dns-beast.com" OR destinationntdomain CONTAINS "don-dns.com" OR destinationntdomain CONTAINS "die-dns.com" OR destinationntdomain CONTAINS "hit-mee.com" OR destinationntdomain CONTAINS "noname-domain.com" OR destinationntdomain CONTAINS "don-die.com" OR destinationntdomain CONTAINS "old-big.com" OR destinationntdomain CONTAINS "you-rabbit.com" OR destinationntdomain CONTAINS "web-lox.com" OR destinationntdomain CONTAINS "tchk-1.com" OR destinationntdomain CONTAINS "ht-specialize.xyz" OR destinationntdomain CONTAINS "ht-input.cfd" OR destinationntdomain CONTAINS "ht-queen.cfd" OR destinationntdomain CONTAINS "ht-dilemma.xyz" OR destinationntdomain CONTAINS "io-strength.cfd" OR destinationntdomain CONTAINS "fbs-university.xyz" OR destinationntdomain CONTAINS "io-previous.xyz" OR destinationntdomain CONTAINS "io-band.cfd" OR destinationntdomain CONTAINS "can-nothing.cfd" OR destinationntdomain CONTAINS "scope-chat.xyz" OR destinationntdomain CONTAINS "stroke-chat.click" OR destinationntdomain CONTAINS "icl-surprise.xyz" OR destinationntdomain CONTAINS "new-high.click" OR destinationntdomain CONTAINS "shrimp-clock.click" OR destinationntdomain CONTAINS "oo-knowledge.xyz" OR destinationntdomain CONTAINS "oo-station.xyz" OR destinationntdomain CONTAINS "oo-blue.click" OR destinationntdomain CONTAINS "oo-strategy.xyz" OR destinationntdomain CONTAINS "oo-clearly.click" OR destinationntdomain CONTAINS "economy-h.xyz" OR destinationntdomain CONTAINS "medical-h.click" OR destinationntdomain CONTAINS "hospital-h.xyz" OR destinationntdomain CONTAINS "church-h.click" OR destinationntdomain CONTAINS "close-h.xyz" OR destinationntdomain CONTAINS "thousand-h.click" OR destinationntdomain CONTAINS "risk-h.xyz" OR destinationntdomain CONTAINS "current-h.click" OR destinationntdomain CONTAINS "fire-h.xyz" OR destinationntdomain CONTAINS "future-h.click" OR destinationntdomain CONTAINS "moment-are.xyz" OR destinationntdomain CONTAINS "himself-are.click" OR destinationntdomain CONTAINS "air-are.xyz" OR destinationntdomain CONTAINS "teacher-are.click" OR destinationntdomain CONTAINS "force-are.xyz" OR destinationntdomain CONTAINS "enough-are.xyz" OR destinationntdomain CONTAINS "education-are.click" OR destinationntdomain CONTAINS "across-are.xyz" OR destinationntdomain CONTAINS "although-are.click" OR destinationntdomain CONTAINS "punishment-chat.click" OR destinationntdomain CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "dns-beast.com" OR requesturl CONTAINS "don-dns.com" OR requesturl CONTAINS "die-dns.com" OR requesturl CONTAINS "hit-mee.com" OR requesturl CONTAINS "noname-domain.com" OR requesturl CONTAINS "don-die.com" OR requesturl CONTAINS "old-big.com" OR requesturl CONTAINS "you-rabbit.com" OR requesturl CONTAINS "web-lox.com" OR requesturl CONTAINS "tchk-1.com" OR requesturl CONTAINS "ht-specialize.xyz" OR requesturl CONTAINS "ht-input.cfd" OR requesturl CONTAINS "ht-queen.cfd" OR requesturl CONTAINS "ht-dilemma.xyz" OR requesturl CONTAINS "io-strength.cfd" OR requesturl CONTAINS "fbs-university.xyz" OR requesturl CONTAINS "io-previous.xyz" OR requesturl CONTAINS "io-band.cfd" OR requesturl CONTAINS "can-nothing.cfd" OR requesturl CONTAINS "scope-chat.xyz" OR requesturl CONTAINS "stroke-chat.click" OR requesturl CONTAINS "icl-surprise.xyz" OR requesturl CONTAINS "new-high.click" OR requesturl CONTAINS "shrimp-clock.click" OR requesturl CONTAINS "oo-knowledge.xyz" OR requesturl CONTAINS "oo-station.xyz" OR requesturl CONTAINS "oo-blue.click" OR requesturl CONTAINS "oo-strategy.xyz" OR requesturl CONTAINS "oo-clearly.click" OR requesturl CONTAINS "economy-h.xyz" OR requesturl CONTAINS "medical-h.click" OR requesturl CONTAINS "hospital-h.xyz" OR requesturl CONTAINS "church-h.click" OR requesturl CONTAINS "close-h.xyz" OR requesturl CONTAINS "thousand-h.click" OR requesturl CONTAINS "risk-h.xyz" OR requesturl CONTAINS "current-h.click" OR requesturl CONTAINS "fire-h.xyz" OR requesturl CONTAINS "future-h.click" OR requesturl CONTAINS "moment-are.xyz" OR requesturl CONTAINS "himself-are.click" OR requesturl CONTAINS "air-are.xyz" OR requesturl CONTAINS "teacher-are.click" OR requesturl CONTAINS "force-are.xyz" OR requesturl CONTAINS "enough-are.xyz" OR requesturl CONTAINS "education-are.click" OR requesturl CONTAINS "across-are.xyz" OR requesturl CONTAINS "although-are.click" OR requesturl CONTAINS "punishment-chat.click" OR requesturl CONTAINS "rjjy-easily.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "guy-seventh.cfd" OR destinationhostname CONTAINS "back-may.com" OR destinationhostname CONTAINS "post-make.com" OR destinationhostname CONTAINS "filesend.live" OR destinationhostname CONTAINS "soft-kind.com" OR destinationhostname CONTAINS "ee-softs.com" OR destinationhostname CONTAINS "big-loads.com" OR destinationhostname CONTAINS "el-softs.com" OR destinationhostname CONTAINS "softs-labs.com" OR destinationhostname CONTAINS "soft-make.com" OR destinationhostname CONTAINS "soft-end.com" OR destinationhostname CONTAINS "soon-soft.com" OR destinationhostname CONTAINS "tip-want.click" OR destinationhostname CONTAINS "get-loads.com" OR destinationhostname CONTAINS "new-loads.com" OR destinationhostname CONTAINS "file-send.live" OR destinationhostname CONTAINS "filetosend-upload.net" OR destinationhostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "guy-seventh.cfd" OR sourcentdomain CONTAINS "back-may.com" OR sourcentdomain CONTAINS "post-make.com" OR sourcentdomain CONTAINS "filesend.live" OR sourcentdomain CONTAINS "soft-kind.com" OR sourcentdomain CONTAINS "ee-softs.com" OR sourcentdomain CONTAINS "big-loads.com" OR sourcentdomain CONTAINS "el-softs.com" OR sourcentdomain CONTAINS "softs-labs.com" OR sourcentdomain CONTAINS "soft-make.com" OR sourcentdomain CONTAINS "soft-end.com" OR sourcentdomain CONTAINS "soon-soft.com" OR sourcentdomain CONTAINS "tip-want.click" OR sourcentdomain CONTAINS "get-loads.com" OR sourcentdomain CONTAINS "new-loads.com" OR sourcentdomain CONTAINS "file-send.live" OR sourcentdomain CONTAINS "filetosend-upload.net" OR sourcentdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "guy-seventh.cfd" OR sourcehostname CONTAINS "back-may.com" OR sourcehostname CONTAINS "post-make.com" OR sourcehostname CONTAINS "filesend.live" OR sourcehostname CONTAINS "soft-kind.com" OR sourcehostname CONTAINS "ee-softs.com" OR sourcehostname CONTAINS "big-loads.com" OR sourcehostname CONTAINS "el-softs.com" OR sourcehostname CONTAINS "softs-labs.com" OR sourcehostname CONTAINS "soft-make.com" OR sourcehostname CONTAINS "soft-end.com" OR sourcehostname CONTAINS "soon-soft.com" OR sourcehostname CONTAINS "tip-want.click" OR sourcehostname CONTAINS "get-loads.com" OR sourcehostname CONTAINS "new-loads.com" OR sourcehostname CONTAINS "file-send.live" OR sourcehostname CONTAINS "filetosend-upload.net" OR sourcehostname CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "guy-seventh.cfd" OR destinationntdomain CONTAINS "back-may.com" OR destinationntdomain CONTAINS "post-make.com" OR destinationntdomain CONTAINS "filesend.live" OR destinationntdomain CONTAINS "soft-kind.com" OR destinationntdomain CONTAINS "ee-softs.com" OR destinationntdomain CONTAINS "big-loads.com" OR destinationntdomain CONTAINS "el-softs.com" OR destinationntdomain CONTAINS "softs-labs.com" OR destinationntdomain CONTAINS "soft-make.com" OR destinationntdomain CONTAINS "soft-end.com" OR destinationntdomain CONTAINS "soon-soft.com" OR destinationntdomain CONTAINS "tip-want.click" OR destinationntdomain CONTAINS "get-loads.com" OR destinationntdomain CONTAINS "new-loads.com" OR destinationntdomain CONTAINS "file-send.live" OR destinationntdomain CONTAINS "filetosend-upload.net" OR destinationntdomain CONTAINS "file-send.cc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "guy-seventh.cfd" OR requesturl CONTAINS "back-may.com" OR requesturl CONTAINS "post-make.com" OR requesturl CONTAINS "filesend.live" OR requesturl CONTAINS "soft-kind.com" OR requesturl CONTAINS "ee-softs.com" OR requesturl CONTAINS "big-loads.com" OR requesturl CONTAINS "el-softs.com" OR requesturl CONTAINS "softs-labs.com" OR requesturl CONTAINS "soft-make.com" OR requesturl CONTAINS "soft-end.com" OR requesturl CONTAINS "soon-soft.com" OR requesturl CONTAINS "tip-want.click" OR requesturl CONTAINS "get-loads.com" OR requesturl CONTAINS "new-loads.com" OR requesturl CONTAINS "file-send.live" OR requesturl CONTAINS "filetosend-upload.net" OR requesturl CONTAINS "file-send.cc")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("0ac34b67e634e49b0f75cf2be388f244","1aa7ad7efb1b48a28c6ccf7b496c9cfd","199017082159b23decdf63b22e07a7a1","a7f17ed79777f28bf9c9cebaa01c8d70")
