def rule(event):
    if any(
        [
            event.deep_get("query", default="").endswith(".hiddenservice.net"),
            event.deep_get("query", default="").endswith(".onion.ca"),
            event.deep_get("query", default="").endswith(".onion.cab"),
            event.deep_get("query", default="").endswith(".onion.casa"),
            event.deep_get("query", default="").endswith(".onion.city"),
            event.deep_get("query", default="").endswith(".onion.direct"),
            event.deep_get("query", default="").endswith(".onion.dog"),
            event.deep_get("query", default="").endswith(".onion.glass"),
            event.deep_get("query", default="").endswith(".onion.gq"),
            event.deep_get("query", default="").endswith(".onion.guide"),
            event.deep_get("query", default="").endswith(".onion.in.net"),
            event.deep_get("query", default="").endswith(".onion.ink"),
            event.deep_get("query", default="").endswith(".onion.it"),
            event.deep_get("query", default="").endswith(".onion.link"),
            event.deep_get("query", default="").endswith(".onion.lt"),
            event.deep_get("query", default="").endswith(".onion.lu"),
            event.deep_get("query", default="").endswith(".onion.ly"),
            event.deep_get("query", default="").endswith(".onion.mn"),
            event.deep_get("query", default="").endswith(".onion.network"),
            event.deep_get("query", default="").endswith(".onion.nu"),
            event.deep_get("query", default="").endswith(".onion.pet"),
            event.deep_get("query", default="").endswith(".onion.plus"),
            event.deep_get("query", default="").endswith(".onion.pt"),
            event.deep_get("query", default="").endswith(".onion.pw"),
            event.deep_get("query", default="").endswith(".onion.rip"),
            event.deep_get("query", default="").endswith(".onion.sh"),
            event.deep_get("query", default="").endswith(".onion.si"),
            event.deep_get("query", default="").endswith(".onion.to"),
            event.deep_get("query", default="").endswith(".onion.top"),
            event.deep_get("query", default="").endswith(".onion.ws"),
            event.deep_get("query", default="").endswith(".onion"),
            event.deep_get("query", default="").endswith(".s1.tor-gateways.de"),
            event.deep_get("query", default="").endswith(".s2.tor-gateways.de"),
            event.deep_get("query", default="").endswith(".s3.tor-gateways.de"),
            event.deep_get("query", default="").endswith(".s4.tor-gateways.de"),
            event.deep_get("query", default="").endswith(".s5.tor-gateways.de"),
            event.deep_get("query", default="").endswith(".t2w.pw"),
            event.deep_get("query", default="").endswith(".tor2web.ae.org"),
            event.deep_get("query", default="").endswith(".tor2web.blutmagie.de"),
            event.deep_get("query", default="").endswith(".tor2web.com"),
            event.deep_get("query", default="").endswith(".tor2web.fi"),
            event.deep_get("query", default="").endswith(".tor2web.io"),
            event.deep_get("query", default="").endswith(".tor2web.org"),
            event.deep_get("query", default="").endswith(".tor2web.xyz"),
            event.deep_get("query", default="").endswith(".torlink.co"),
        ]
    ):
        return True
    return False
