alert ip anY any -> any any ( flowbits:set,Emsg:"S[RICA0.10!irection"; flow:established; app-layer-event:                                                                           (               "                                    t:.com"; _4;)