Connection to Common Large Language Model Endpoints

network where host.os.type in ("macos", "windows") and dns.question.name != null and
(
  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
  "bitsadmin.exe", "InstallUtil.exe", "RegAsm.exe", "vbc.exe", "RegSvcs.exe", "regsvr32.exe", "dllhost.exe",
  "node.exe", "javaw.exe", "java.exe", "*.pif", "*.com", "python*", "osascript", "Script Editor", "curl", "curl.exe", "deno", 
  "deno.exe", "node", "bun", "bun.exe") or

  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or

  (
    process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe", "/Users/Shared/*", "/Library/WebServer/*", 
                          "/Users/*/Library/WebServer/*", "/Library/Graphics/*", "/Users/*/Library/Graphics/*", "/Library/Fonts/*", 
                          "/Users/*/Library/Fonts/*", "/private/var/root/Library/HTTPStorages/*", "/tmp/*", "/var/tmp/*", "/private/tmp/*") and
    (?process.code_signature.trusted == false or ?process.code_signature.exists == false)
  )
 ) and
    dns.question.name : (
    // Major LLM APIs
    "api.openai.com",
    "*.openai.azure.com",
    "api.anthropic.com",
    "api.mistral.ai",
    "api.cohere.ai",
    "api.ai21.com",
    "api.groq.com",
    "api.perplexity.ai",
    "api.x.ai",
    "api.deepseek.com",
    "api.gemini.google.com",
    "generativelanguage.googleapis.com",
    "api.azure.com",
    "api.bedrock.aws",
    "bedrock-runtime.*.amazonaws.com",

    // Hugging Face & other ML infra
    "api-inference.huggingface.co",
    "inference-endpoint.huggingface.cloud",
    "router.huggingface.co",
    "*.hf.space",
    "*.replicate.com",
    "api.replicate.com",
    "api.runpod.ai",
    "*.runpod.io",
    "api.modal.com",
    "*.forefront.ai",

    "api.arcee.ai",
    "api.sambanova.ai",
    "chatapi.akash.network",
    "api.reka.ai",
    "api.cerebras.ai",
    "api.morphllm.com",
    "openrouter.ai",
    "api.moonshot.cn",
    "api.moonshot.ai",
    "api.z.ai",
    "api.inference.wandb.ai",
    "trace.wandb.ai",
    "api.bfl.ai",
    "api.eu.bfl.ai",
    "api.us.bfl.ai",
    "api.ionstream.ai",
    "api.minimax.io",
    "api.minimaxi.com",
    "api.stepfun.ai",
    "api.stepfun.com",
    "api.featherless.ai",
    "api.intelligence.io.solutions",
    "api.fireworks.ai",
    "inference.baseten.co",
    "api.baseten.co",
    "api.gmi-serving.com",
    "api.ncompass.tech",
    "api.nextbit256.com",
    "api.hyperbolic.xyz",
    "neuro.mancer.tech",
    "managed-inference-api-proxy.crusoecloud.com",
    "api.crusoe.ai",
    "api.avian.io",
    "api.siliconflow.cn",
    "api.totalgpt.ai",
    "switchpoint.dev",
    "api.novita.ai",
    "api.inflection.ai",
    "api.wavespeed.ai",
    "api.cloud.mara.com",
    "api.inference.net",
    "api.deepinfra.com",
    "api.xiaomimimo.com",
    "dashscope.aliyuncs.com",
    "dashscope-intl.aliyuncs.com",
    "dashscope-us.aliyuncs.com",
    "integrate.api.nvidia.com",
    "api.inceptionlabs.ai",
    "api.friendli.ai",
    "external.api.recraft.ai",
    "api.cloudflare.com",
    "gateway.ai.cloudflare.com",
    "api.studio.nebius.ai",
    "api.tokenfactory.nebius.com",
    "api.aionlabs.ai",
    "api.relace.run",
    "instantapply.endpoint.relace.run",
    "ranker.endpoint.relace.run",
    "embeddings.endpoint.relace.run",
    "console-api.inference.ai",
    "api.parasail.io",
    "api.redpill.ai",
    "api.modular.com",
    "ark.cn-beijing.volces.com",
    "ark.ap-southeast.bytepluses.com",
    "ai2endpoints.cirrascale.ai",
    "aisuite.cirrascale.com",
    "api.clarifai.com",
    "api.venice.ai",
    "api.atlascloud.ai",
    "wanqing.streamlakeapi.com",
    "api.ambient.xyz",
    "api.upstage.ai",
    "api.together.xyz",
    "api.inceptron.io",
    "chutes.ai",
    "aiplatform.googleapis.com",
    "portal.nousresearch.com",
    "inference-api.nousresearch.com",
    "api.githubcopilot.com",
    "ai-gateway.vercel.sh",
    "opencode.ai",
    "api.kilo.ai",
    "qianfan.baidubce.com",
    "hunyuan.tencentcloudapi.com",
    "open.bigmodel.cn",
    "spark-api-open.xf-yun.com",
    "api.sensenova.cn",
    "api.baichuan-ai.com",
    "api-inference.modelscope.cn",
    "api.lingyiwanwu.com",
    "api.360.cn",

    // Consumer-facing AI chat portals
    "chat.openai.com",
    "chatgpt.com",
    "copilot.microsoft.com",
    "bard.google.com",
    "gemini.google.com",
    "claude.ai",
    "perplexity.ai",
    "poe.com",
    "chat.forefront.ai",
    "chat.deepseek.com",

    // OpenClaw
    "openclaw.ai"
  ) and

  not process.executable : (
          "?:\\Program Files\\*.exe",
          "?:\\Program Files (x86)\\*.exe",
          "?:\\Windows\\System32\\svchost.exe",
          "?:\\Windows\\SystemApps\\Microsoft.LockApp_*\\LockApp.exe",
          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe"
        ) and
    not (?process.code_signature.trusted == true and
         ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS",
                                                  "OpenJS Foundation", "Developer ID Application: Node.js Foundation (HX7739G8FX)"))