alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/As"; flow:established; app-layer-event:applayer_mismatch_protoco,::,any,::,::E24,10::,::E/24]I@.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,1.0/24p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T21724.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,1.0/24p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/TG,94.102.49.0/24,7![!p [163.60..48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,1.0/24,89.248.172.0/24] any -24,89.248.1,89.248.172.0/24] any -24,89.248.172.0/24] any -> $ any (28;)