Subscribers become interested in competitors’ offers. To do this, they start regularly visiting competitors’ websites and aggregators. Search queries are not visible in clickstream data, but the final URLs can be tracked.
DPI exports ClickStream — all HTTP/HTTPS requests of users on the Internet. The QoE module aggregates information for each IP (login, if used). The statistics record the URL for HTTP and the domain name for HTTPS.
Required steps for detection:

match host (?i)(\W|^)(rt.ru|domru.ru.com)(\W|$)
Example database query:
Download the script here
The script returns a list of subscribers who visited the specified competitors’ websites ANY number of times over the last 24 hours.
Run: sh subs_search_for_competitors_sample.sh
Script parameters:
format="CSV" — output format. Default is CSV. Possible formats: https://clickhouse.com/docs/en/interfaces/formats/
periodSecs=24*3600 — period in seconds. Default is 24 hours
hostsMatch="(?i)(\W|)(rt.ru|domru.ru.com)(\W|$)" — regular expression for searching multiple hosts. It is recommended to add relevant local competitors here.