alert ip any _ny,,2226,,,l -> any !ny (msg:"S24vtion"; flow:established; app-layer-event:                                           C                                                                                    t:.com"; _4;)