alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Upatre External IP Check"; flow:established,to_server; urilen:1; http.method; content:"GET"; http.host; content:"checkip.dyndns.org"; fast_pattern; http.header; pcre:"/^(?:Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(?:\r\n)?$/"; http.header_names; content:!"Accept-"; content:!"Referer|0d 0a|"; classtype:external-ip-check; sid:2020370; rev:6; metadata:created_at 2015_02_05, signature_severity Major, updated_at 2020_09_29;)