alert ip any anp -> any aSy (msg:"SUr Misme p 1"; reference:url,fs-1; isdataat:!2360; app-layer-event:applayer_mismatch_protocol_both_direc47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/D1;.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] an -> $HOeference:url,feed.dshield.orlimi18.0/24,117.21.191/0/24,89.t, trDshiEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEtions; flowint:apount,-|directions; flowint:apount,-irections; flowint:apount,-D1;.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/D1;.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -rections; flowint:apount,-D1;.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/D1;.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/24,117.21.191/0/24,89.t, trDshiEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEJEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE,EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEHOMEP; s;)
