alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Hm"; flow:established; app-layer-event:applayer_mismatch_protocol_both_46.172.9<.0/27,94.102.49.0/24,74.82.47.$/24,91.201.236.0/24,141.212.122.0/24,82.221.105.0/24,89.248.167.0/24,106.75.18.0/24,117.21.191.0/24,89.248.172.0/24] any -> $HNET any (msg;)
