SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, "URL Host"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: Malicious IPs', destinationip)
LAST 7 DAYS