We noticed recently that the Detect hosts connecting to dynamic domain providers detection fired for query="image.news.rossignol.com".
It led me to line #57143 in dynamic_dns_providers_default.csv:
dynamic_dns_domains, isDynDNS_default
*.news.ro*, True
I noticed all entries in the CSV file end up with a * wildcard at the end. Was that the intention all along?
I've tested in out environment and it should work quite fine if we remove it.
Happy to open a PR if you guys think the same.