That one appeared to set a replication host and then uses a canary DNS record to do the triggering. The canary payload is just base64 encoded, so it's not hard

That one appeared to set a replication host and then uses a canary DNS record to do the triggering. The canary payload is just base64 encoded, so it's not hard to reverse engineer if you spot it.