alert ip any tny,,2:26,8,, -> any !ny (app-layer-event:applayer_mismatch_protocol_both_isectioflowintnd.php"; http_uf ; content:".com"; gttp_heac iot:"@OST"; ht4;))