def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 3008,
            any(
                [
                    event.deep_get("QueryName", default="").endswith(".hiddenservice.net"),
                    event.deep_get("QueryName", default="").endswith(".onion.ca"),
                    event.deep_get("QueryName", default="").endswith(".onion.cab"),
                    event.deep_get("QueryName", default="").endswith(".onion.casa"),
                    event.deep_get("QueryName", default="").endswith(".onion.city"),
                    event.deep_get("QueryName", default="").endswith(".onion.direct"),
                    event.deep_get("QueryName", default="").endswith(".onion.dog"),
                    event.deep_get("QueryName", default="").endswith(".onion.glass"),
                    event.deep_get("QueryName", default="").endswith(".onion.gq"),
                    event.deep_get("QueryName", default="").endswith(".onion.guide"),
                    event.deep_get("QueryName", default="").endswith(".onion.in.net"),
                    event.deep_get("QueryName", default="").endswith(".onion.ink"),
                    event.deep_get("QueryName", default="").endswith(".onion.it"),
                    event.deep_get("QueryName", default="").endswith(".onion.link"),
                    event.deep_get("QueryName", default="").endswith(".onion.lt"),
                    event.deep_get("QueryName", default="").endswith(".onion.lu"),
                    event.deep_get("QueryName", default="").endswith(".onion.ly"),
                    event.deep_get("QueryName", default="").endswith(".onion.mn"),
                    event.deep_get("QueryName", default="").endswith(".onion.network"),
                    event.deep_get("QueryName", default="").endswith(".onion.nu"),
                    event.deep_get("QueryName", default="").endswith(".onion.pet"),
                    event.deep_get("QueryName", default="").endswith(".onion.plus"),
                    event.deep_get("QueryName", default="").endswith(".onion.pt"),
                    event.deep_get("QueryName", default="").endswith(".onion.pw"),
                    event.deep_get("QueryName", default="").endswith(".onion.rip"),
                    event.deep_get("QueryName", default="").endswith(".onion.sh"),
                    event.deep_get("QueryName", default="").endswith(".onion.si"),
                    event.deep_get("QueryName", default="").endswith(".onion.to"),
                    event.deep_get("QueryName", default="").endswith(".onion.top"),
                    event.deep_get("QueryName", default="").endswith(".onion.ws"),
                    event.deep_get("QueryName", default="").endswith(".onion"),
                    event.deep_get("QueryName", default="").endswith(".s1.tor-gateways.de"),
                    event.deep_get("QueryName", default="").endswith(".s2.tor-gateways.de"),
                    event.deep_get("QueryName", default="").endswith(".s3.tor-gateways.de"),
                    event.deep_get("QueryName", default="").endswith(".s4.tor-gateways.de"),
                    event.deep_get("QueryName", default="").endswith(".s5.tor-gateways.de"),
                    event.deep_get("QueryName", default="").endswith(".t2w.pw"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.ae.org"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.blutmagie.de"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.com"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.fi"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.io"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.org"),
                    event.deep_get("QueryName", default="").endswith(".tor2web.xyz"),
                    event.deep_get("QueryName", default="").endswith(".torlink.co"),
                ]
            ),
        ]
    ):
        return True
    return False
