def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("query", default="").endswith(".burpcollaborator.net"),
                    event.deep_get("query", default="").endswith(".canarytokens.com"),
                    event.deep_get("query", default="").endswith(".ceye.io"),
                    event.deep_get("query", default="").endswith(".ddns.1443.eu.org"),
                    event.deep_get("query", default="").endswith(".ddns.bypass.eu.org"),
                    event.deep_get("query", default="").endswith(".ddns.xn--gg8h.eu.org"),
                    event.deep_get("query", default="").endswith(".digimg.store"),
                    event.deep_get("query", default="").endswith(".dns.su18.org"),
                    event.deep_get("query", default="").endswith(".dnshook.site"),
                    event.deep_get("query", default="").endswith(".dnslog.cn"),
                    event.deep_get("query", default="").endswith(".dnslog.ink"),
                    event.deep_get("query", default="").endswith(".instances.httpworkbench.com"),
                    event.deep_get("query", default="").endswith(".interact.sh"),
                    event.deep_get("query", default="").endswith(".log.dnslog.pp.ua"),
                    event.deep_get("query", default="").endswith(".log.dnslog.qzz.io"),
                    event.deep_get("query", default="").endswith(".log.dnslogs.dpdns.org"),
                    event.deep_get("query", default="").endswith(".log.javaweb.org"),
                    event.deep_get("query", default="").endswith(".log.nat.cloudns.ph"),
                    event.deep_get("query", default="").endswith(".oast.fun"),
                    event.deep_get("query", default="").endswith(".oast.live"),
                    event.deep_get("query", default="").endswith(".oast.me"),
                    event.deep_get("query", default="").endswith(".oast.online"),
                    event.deep_get("query", default="").endswith(".oast.pro"),
                    event.deep_get("query", default="").endswith(".oast.site"),
                    event.deep_get("query", default="").endswith(".oastify.com"),
                    event.deep_get("query", default="").endswith(".p8.lol"),
                    event.deep_get("query", default="").endswith(".requestbin.net"),
                ]
            ),
            not "polling.oastify.com" in event.deep_get("query", default=""),
        ]
    ):
        return True
    return False
