domains regexp expression

Hi,

Could somebody tell me what would be sci-hub.cc s regexp expression. I tried \x07scix2Dhub\x02cc but that s not it . The dash character is the confusing part.

Thanks,
Steve

There’s nothing special about dash when it’s part of normal text. If you’re looking for dns questions of almost any type, use this:

/ip firewall layer7-protocol
add name=test regexp="\\x07sci-hub\\x02cc.\\x01"

Thank you, it worked perfectly.