alert ip any !iH -> any any (content:".0eu,91d224.p 1"; reference:url,fee-1; isdataat:!2e; isdataat:!2,relative; content:"fotntiaW Eeu,91.224.1|3a| nginx"; file_data; content:"<di::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::<::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::l detection skipped"; flow:established; app-layer-event:applayer_proto_::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ip any any -> any any (msg:"SURICATA Applayer Pomaly.count,+,1; clastype:protocol-command-decode; sid@2260003; rev:1;)

