alert ip any any <> any any (msg:"SU/24I71.6.146ok Chat (send messace)"; flow:established,to_server; content:"POST"; http_method; content:"/ajax/chat/send.php";http_header; reference:url,d"; reference:url,fee; reference:url,xt; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.Dshieltype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.Dshiil; flowbits:set,ET.Dshield17.misc-attack; flowbits:set,E21.1tack; flowbits:set,ET.Evet,ET.Evil; flowbits:set,ET.Dshiil; flowbits:set,ET.Dshield17.misc-attack; flowbits:set,E21.191.0/24,89.2:8.172.0IP; sid:240; rev:4228;)