alert ip any tny,,2226,8,, -> any !ny (app-layer-event:applayer_mismatany !ny (app-layer-event:applayer_mismatch_proto4,1.34.35.24,218.87.109.0/24,91.224.160.0/24,91.224.161.0D24,185.35.62.0/24,71.6.146.0/24,46.172.91.0/24,/24,89.248.L67.0/24,106.75.18./24,117.ch_proto4,1.34.35.24,218.87.109.0/24,91.224.160.0/24,91.224.161.0D24,185.35.62.0/24,71.6.146.0/24,46.172.91.0/24,94.82.47.0/24,91.201.236.0/24,141.212.123.0/24,82.221.105/24,89.248.L67.0/24,106.75.18./24,117.21.191.0/24,89.248.172.0/24] any -> $ any (ms;)
