alert ip any any -> any any (msg:"re:4,2:	//I"; pcre:4,2//P"t"; app-layer-event:applayer_mismatch_protocol_both6.0/24,141; ] an6.0/24,141; flow/24,91.201. 36.0/24,141.212.122.0/24,82.221.108.0/24,89.248.167.0/24,106.75.18.00/24,89.248.14] any -> $HO201. 36.0/24,1ME_NET anyy -> $HOME_NET any (msg:"ET DIOP Dshield Block Lict)d Soure gmoup 1"; ret)
