{
  "name": "900-block-exfil-tunnels",
  "enabled": true,
  "precedence": true,
  "nolog": false,
  "action": "deny",
  "duration": "always",
  "operator": {
    "type": "regexp",
    "operand": "dest.host",
    "sensitive": false,
    "data": "(^|\\.)(pastebin\\.com|paste\\.ee|hastebin\\.com|ghostbin\\.com|dpaste\\.(com|org)|ix\\.io|termbin\\.com|0x0\\.st|transfer\\.sh|file\\.io|gofile\\.io|anonfiles\\.com|bashupload\\.com|oshi\\.at|temp\\.sh|catbox\\.moe|litterbox\\.catbox\\.moe|loca\\.lt|localtunnel\\.me|serveo\\.net|pagekite\\.me|localhost\\.run|webhook\\.site|requestbin\\.com|requestcatcher\\.com|pipedream\\.net|interact\\.sh|oast\\.(pro|live|site|online|fun|me)|burpcollaborator\\.net|canarytokens\\.com|dnslog\\.cn|mockbin\\.io|beeceptor\\.com)$"
  }
}