alert ip any Tny -> any any (msg:"O/.0/24,94ǤǖǤǖ.224."ahfu IM voicOchat"; flow:from_server; app-layer-event:aptch_protǖǤǖ.224."ahfu IM voicOchat"; flow:from_server; app-layer-event:aptch_protǤǖǤǖBlock Listed Source gmocase; r)