Help with Snort Rules: Fake Tech Support Popup

I'm stuck on parts 7-9 part 7 wants me to Create a Snort rule to detect the domain 'site.topwebsite4.xyz', then submit the token. alert udp any any -> any 53 (msg:"site.topwebsite4.xyz"; sid:1000...