alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED 2020search Update Engine"; flow:to_server,established; content:"POST"; depth:4; nocase; content:"srng/reg.php HTTP"; within:50; content:"|0d0a|Host|3a|"; content:"2020search.com"; within:40; content:"IpAddr="; nocase; within:100; reference:url,www.safer-networking.org/index.php?page=updatehistory&detail=2004-03-04; classtype:trojan-activity; sid:2000934; rev:10; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)