alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Newzbin Usenet Reader License Check"; flow:established,to_server; http.uri; content:"/internal/"; content:"prodID=nl&licID="; content:"&prodVer="; http.host; content:"www.newsleecher.com"; startswith; classtype:policy-violation; sid:2009095; rev:4; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2024_02_06;)