def rule(event):
    if any(
        [
            event.deep_get("query", default="").endswith(".duckdns.org"),
            event.deep_get("query", default="").endswith(".top"),
            event.deep_get("query", default="").endswith(".ddns.net"),
            event.deep_get("query", default="").endswith(".gl.at.ply.gg"),
            event.deep_get("query", default="").endswith(".portmap.io"),
            event.deep_get("query", default="").endswith(".icu"),
            event.deep_get("query", default="").endswith(".zapto.org"),
            event.deep_get("query", default="").endswith(".live"),
            event.deep_get("query", default="").endswith(".hopto.org"),
            event.deep_get("query", default="").endswith(".portmap.host"),
            event.deep_get("query", default="").endswith(".sbs"),
            event.deep_get("query", default="").endswith(".sytes.net"),
            event.deep_get("query", default="").endswith(".click"),
            event.deep_get("query", default="").endswith(".ydns.eu"),
            event.deep_get("query", default="").endswith(".site"),
            event.deep_get("query", default="").endswith(".cloud"),
            event.deep_get("query", default="").endswith(".no-ip.org"),
            event.deep_get("query", default="").endswith(".kozow.com"),
            event.deep_get("query", default="").endswith(".lat"),
            event.deep_get("query", default="").endswith(".pro"),
        ]
    ):
        return True
    return False
