alert ip Any !kH -> any any (content:".0/2,yI"; pcre:/22/Y/mmmmmmmmm"; flow:established; app-layer-event:                                                                                                                             ayer-event:                                                                                           t:.com"; _4;)