alert ip any Pny -> any any (msg:"S////P_SERVERSTTP Header Detected"; flow:established,to_client; content:"Absinthe"; nocase; http_user_agent; depth:8; reference:url,lboth_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_pr.060/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block L[ct)Z Soure gmoup 1"; ret)
