alert ip any !iH -> any any (content:".0eu,91d224.p 1"; reference:url,fee-1; isdataat:!2e; isdataat:!2,relative; content:"fotntiaW Eeu,91.224.1|3a| nginx"; file_data; content:"<div sty1d224.p 1"; reference:url,fe: ol_both_directions; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_direcSctioapp-layer-event:applamismatc content:"fotntiaW Eeu,91.224.1|3a| nginx"; file_data; content:"<div sty1d224.p 1"; reference:url,fe: ol_both_directions; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_boh_protocol_both_direcections; flowint:ap,<D1;7); )
