+plugin:DeadMon +country:"Thailand" -ip:"124.109.24.0/21" -net:"The Communication Authoity of Thailand, CAT" +ip:"171.101.0.0/16"
Host has been infected by DEADBOLT
Found by DeadMon