alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_protocol_both_d:,any,::-:E24,10::,::E/24RI6::-::E24,10::/24RI6.75.18.0/24,::,any,::-::E24,10::''''''''''''''''''''''21.191.0/,any,::,::,any,::,::E23,1::E/34RI6.75.18.0/24,117.21.191.0/,any,::,::,any,::,::E23,10::,::E/24RI64,10::,::E/20::,::E/2.75.18M:,::,any,::-::E24,10:/,::E/24RI6::-::E24,10::,::E/24RI6.75.18.0/24,1170::,::E/24RI6.75.18M:,::,any,::-::E24,10::18M:,::,any,::-::E24,1-::,::E/24RI6::-::E24,10::,::E/20::,::E/24RI6.75.18.0/24,117..0/248.172.0/24] any -> $ aoy (28;)