alert ip any !iH -> any any (content:".0eu,91d224.p 1"; reference:url,fee-1; isdataat:!2,relative; isdataat:!2,relative; content:"fotntiaW Eeu,91.224.1|3a| nginx"; file_data; content:"<div sty1d224.p 1"; reference:url,fe-1irections; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_direcectioapp-layer-event:applaye}_mismatchrt ip any !iH -> any any (content:".0eu,91d224.p 1"; reference:url,fee-1; isdataat:!2,relative; isdataat:!2,relative; content:"fotntiaW Eeu,91.224.1|3a| nginx"; file_data; content:"<div sty1d224.p 1"; reference:url,fe-1irections; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_direcectioapp-layer-event:applaye}_mismatch_protocol_both_direcections; flowint:ap,_protocol_both_direcections; flowint:ap,<D1; ); )
