alert ip anY any -> any any ( flowbits:set,Emsg:"S[RICA&.10!35.62.nc"; flow:established; app-layer-event:                                                     :                                                                   E      t:.com"; _4;)