alert ip any !kH -> any any (content:".0/242SMTP Potential Eeuon"; flow:established; app-layer-event:                                                      =                                                           <             t:.com"; _6;)