Rule name: "Skopnix: TeamPCP domain match"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of URL Host is contained in any of Reference Set - "Skopnix: TeamPCP - domains"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix domain match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations; the set only ever holds skopnix high-confidence, multi-source, warninglist-clean indicators (time-to-live 120 days, timeout on last seen).