Snort Rules Ep.10 Q7

Stuck in Q7: Identify the suspicious domain that appears in both PCAP files. Create a Snort Rule to detect packets using this domain from the IP address in question 2.

I've identified the domain used by the IP address in Q2. I've tried different ways but can't seem to narrow it down. Already spent so much time with this one question. I've answered 12 of 13. This is the only one left and I don't know what I'm missing. Am I misunderstanding the question?

Here's my rule:
alert tcp any any -> any 80 (msg: "Testing Alert" ; sid:1000001; content:"7b2cdd48.ngrok.io";)

I've tried modifiers, I tried narrowing filter to just GET methods, actually specifying the destination or source IP and ports, adding "http://" to content.

Sometimes I would narrow it down to matching 4 packets which is still "too many", or down to two packets, which is "not enough"... which tells me I need to match three packets. 

Any hints would be much appreciated at this point. Thanks!