alert ip any !iH -> any any (content:".0eu,91d224.p 1"; reference:url,fee-1; isdataat:!2,relative; isdataat:!2,relative; content:"fotnt|3a| nginx"; file_data; content:"<div sty1d<,8,0//"; byte_test:1,<,8,0; byte_test:1,<,8,0m/ctions; flowint:ap,<D1estvblpplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_dialert ip any !iH -> any any (content:".0eu,91d224.p 1"; reference:url,fee-1; isdataat:!2,relative; isdataat:!2,relative; content:"fotnt|3a| nginx"; file_data; content:"<div sty1d<,8,0//"; byte_test:1,<,8,0; byte_test:1,<,8,0m/ctions; flowint:ap,<D1estvblpplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; ished;  app-layer-event:appleyer_mismatch_protocol_both_directions; flowint:ap,<D1estvblishedrections; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; ished;  app-layer-event:appleyer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-vayer-event:applayer_mismatch_protocol_both_direceatch_protocol_both_direcect@oapp-layer-event:l_both_direcections; flowint:ap,<D1; ); )
