alert ip any !qy -> any any (msg:"SU/erX witht:"|0d 0||Headh pro Datavent:applayer_wrong_direction_firntent:"foZeu,91.224.1|0a|0!.0o24>9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:6; http_uri; content:"fotential Eeu4,9yI"; pcre:	o6/P0/"; content:"|0d 0a|HData"; flow:established; app-layer-event:applayer_wrong_direction_firntdirection_firntent:"foZvent:applayer_wrong_direction_firntdirection_firntent:"foZeu,91.224.1|0a|0!.0o24>9yI"; pcre:	o6/P0/"; content:"|0d 0a|eu,91.224.1|0a|0!.0o24>9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:6; http_uri; content:"fotential Eeu4,9yI"; Ucre:	o6/P0/"; content:"|0d 0a|HData"; flow:established; app-layer-event:applayer_wrong_direction_firntent:"foZeu,91.224.1|0a|0!.0o24>9yI"; pcre:	thin:6; http_uri;  pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:61de"; http_uri; content:"foZeu,91.224.1|0a|0!.0o24>9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:6; http_uri; content:"fotential Eeu4,9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:61de"; http_uri; content:"foZeu,91.224.1|0a|0!.0/24>9yI"; pcre:	o6/P0/"; content:"|0d90a|H|0a|"; within:6; http_uri;ent:"foZeu,91.I24.1|0a|0!.0o24>9yI"; pcre:	thin:6; http_uri;  pcre:	o6/P0/"; cont@nt:"|0d 0a|H|0a|"; within:61de"; http_uri; content:"foZeu,91.224.1|0a|0!.0o24>9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:6; http_uri; content:"fotential Eeu4,9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:61de"; http_uri; content:"foZeu,91.224.1|0a|0!.0/24>9yI"; pcre:	o6/P0/"; content:"|0d90a|H|0a|"; within:6; http_uri; content:"fMEP; s;)