alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Pagekite Tunneling Service ping Heartbeat"; flow:established,to_server; http.method; content:"HEAD"; http.uri; bsize:5; content:"/ping"; http.header_names; content:"|0d 0a|Host|0d 0a 0d 0a|"; http.host; bsize:13; content:"ping.pagekite"; fast_pattern; threshold:type limit,track by_src,count 5,seconds 300; reference:url,github.com/pagekite/libpagekite; classtype:misc-activity; sid:2067928; rev:1; metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2026_02_26, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag Tunnel, updated_at 2026_02_26; target:src_ip;)