alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO HTTP Request to a *.zip Domain"; flow:established,to_server; http.host; content:".zip"; endswith; reference:url,www.registry.google/announcements/launch-details-for-eight-new-tlds/; classtype:misc-activity; sid:2045975; rev:3; metadata:created_at 2023_05_31, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_06_05; target:src_ip;)