alert dns $HOME_NET any -> any any (msg:"ET MALWARE Fbot/Satori CnC DNS Lookup (rippr .cc)"; dns.query; content:"rippr.cc"; nocase; fast_pattern; endswith; reference:url,blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/; classtype:command-and-control; sid:2026325; rev:3; metadata:affected_product Linux, attack_target Server, created_at 2018_09_20, deployment Perimeter, malware_family Satori, malware_family Fbot, performance_impact Low, confidence Medium, signature_severity Major, tag Worm, tag DDoS, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_16;)