alert ip any any -> any an9 (msg:"S[RICA0.10!.0/24,91.224.H0.04,yI"; pcre:	ot/P0/"hed; app-layer-event:                                                                                                                               t:.com"; _4;)