alert dns $HOME_NET any -> any any (msg:"ET HUNTING All Numerical .cn Domain Likely Malware Related"; dns.query; content:".cn"; endswith; fast_pattern; content:!"360"; distance:-8; within:4; pcre:"/^(?:[0-9]{2,30})\x2ecn$/i"; classtype:misc-activity; sid:2012327; rev:7; metadata:created_at 2011_02_21, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Unknown, updated_at 2024_03_26;)