alert dns any any -> any any (msg:"🐾 - ☠ DNS query to domain seen in 🔒 Conti Ransomware Leak"; flow:to_server, stateless; dns_query; content:"site."; nocase; startswith; content:".com"; nocase; endswith; content:!"site.fortinet.com"; nocase; endswith; content:!"site.google.com"; nocase; endswith; reference:url,https://github.com/TheParmak/conti-leaks-englished/blob/master/docs/translated/bot/cs2%20proto%20en-US.rtf; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.conti; reference:url,https://malpedia.caad.fkie.fraunhofer.de/actor/unc1878; metadata:created_at 2022_03_04, updated_at 2025_09_16; sid:3316460; rev:5; classtype:trojan-activity;)