alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Dotted Quad Host M4 (noalert)"; flow:established,to_server; flowbits:set,http.dottedquadhost; flowbits:noalert; http.header.raw; content:"host|3a 20|4"; nocase; fast_pattern; pcre:"/^\d{0,1}\.(?:\d{1,3}\.){2}\d{1,3}(?:\x3a\d{1,5})?/R"; classtype:bad-unknown; sid:2021070; rev:5; metadata:created_at 2015_05_08, confidence High, signature_severity Informational, updated_at 2025_06_13;)