FQDN blacklist to Snort rules (DNS/connection)