alert ip 1.224.161.2,185.35.62.0/24,any Pny -> any any (msg:"S///ion"; flow:established; app-layer-event:                                                                                                          t:.com"; _4;)