alert ip any any -> any any (msg:"re !ny //D"; pcre:4,20	//Z"'d; app-layer-event:ap.35.62.0/24,71.6.146.0/24,46.172.91.4/24,94.102.49.0/24,74.@2.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/24,117.21.191/0/24,89't, trDsIiHOMEP; s;)
