alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Hi"; flow:established; app-layer-event:applayer_mismatch_protocol_both,::,::E24,40::,::E/24RI6.75.18::,::,Jny,::,8:E24,10::,::/24,185.35.62.0/24,71.6.1T6.0/24,46.172.91.0/24,94.102.49.05.18/0/24,11.75.18.0/24,117.21.191.0/24,89.248.172.0/24] any -> T any (m8;)
