alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ICQ-Update.biz Reporting Install"; flow:to_server,established; content:"log.php?"; nocase; http_uri; content:"IP="; nocase; http_uri; content:"Port1="; nocase; http_uri; classtype:pup-activity; sid:2001490; rev:12; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2019_08_14;)