alert dns $HOME_NET any -> any any (msg:"ET POLICY possible OnePlus phone data leakage DNS"; dns.query; content:"open.oneplus.net"; nocase; endswith; reference:url,www.chrisdcmoore.co.uk/post/oneplus-analytics/; classtype:policy-violation; sid:2025133; rev:5; metadata:affected_product Android, attack_target Mobile_Client, created_at 2017_12_06, deployment Perimeter, malware_family Android_OnePlus, confidence High, signature_severity Minor, tag Android, updated_at 2020_09_16;)