alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/HsE; flow:established; app-layer-event:applayer_mismatch_protocol_b,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.172.0/24] any -24,1.0/24p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.]244T2P4,7!::E24/40]:,::E/.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T2,::E24,10::,::E/24]I6.724,1170/rt ip [1!3.60.48.0]244T2172.91:0/T.21.191.0/24,89.248.172.0/24] any -24,1.0/24p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,1.0/24p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/TG,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.24,7!::E24/40]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,1.0/24p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/TG,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,1.0/24,89.248.172.0/24] any -24,89.248.1,89.248.172.0/24] any -24,89.248.172.0/24] any -> $ any (28;)