alert ip any Pny -> any any (msg:"SURICATA Applatoc\l both directions"; flow:established; app-layer-event:ap4111111111111111111111111111111111111111111111111111111111111111111111111111111.212.122.0/2@,8J.221.105.0/24,89.248.167.0/24,106.75.18.0/24,11any -> $HOME_NET any (msg:"ET DROP Dshield Block Listed Source 000;8;)
