AIRLOCKPlay Gate

Rules

Export policy

Allow official Play by domain and AS15169 egress. Drop listed C2. Do not emit Google anycast as a block list.

  1. 01

    Allow

    Play domains on 443 / FCM ports. Resolver or SNI policy — not pinned IPs.

  2. 02

    Hunt

    Installer MD5, package names, non-Google C2 IPs and lure hosts.

  3. 03

    Hold

    Never block play.google.com or the other standing names.

# AIRLOCK Play Gate
# Official Play is not an IOC. Allow by domain. Block malware by hash / C2.
# Do not hardcode Google anycast IPs (AS15169). Ranges: goog.json minus cloud.json.
# Never block: play.google.com, play.googleapis.com, android.clients.google.com

drop ip any any -> 66.206.6.6 8080 (msg:"AIRLOCK Anatsa C2"; sid:2260911; rev:1;)
drop ip any any -> 162.252.173.37 85 (msg:"AIRLOCK Anatsa C2"; sid:2260912; rev:1;)
drop ip any any -> 185.215.113.108 85 (msg:"AIRLOCK Anatsa C2"; sid:2260913; rev:1;)
drop ip any any -> 193.24.123.18 85 (msg:"AIRLOCK Anatsa C2"; sid:2260914; rev:1;)
drop ip any any -> 156.244.19.63 any (msg:"AIRLOCK SpyNote C2"; sid:2260915; rev:1;)
drop dns any any -> any any (msg:"AIRLOCK SpyNote lure"; dns.query; content:"bafanglaicai888.top"; nocase; sid:2260916; rev:1;)
drop dns any any -> any any (msg:"AIRLOCK PlayPraetor C2 DNS"; dns.query; content:"mskidsakw.top"; nocase; sid:2260917; rev:1;)
drop dns any any -> any any (msg:"AIRLOCK PlayPraetor C2 DNS"; dns.query; content:"fadisakwa.top"; nocase; sid:2260918; rev:1;)
drop dns any any -> any any (msg:"AIRLOCK PlayPraetor lure"; dns.query; content:"play-google-app.ormatz.com"; nocase; sid:2260919; rev:1;)
drop dns any any -> any any (msg:"AIRLOCK PlayPraetor lure"; dns.query; content:"play-google-app.dr1solar.com"; nocase; sid:2260920; rev:1;)

# Do not write drop rules for play.google.com, play.googleapis.com, android.clients.google.com.