alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Pagekite Tunneling Service ping Heartbeat Response"; flow:established,to_client; http.header; content:"X-PageKite-UUID|3a 20|"; fast_pattern; pcre:"/^[a-f0-9]{40}/R"; threshold:type limit,track by_src,count 5,seconds 300; reference:url,github.com/pagekite/libpagekite; classtype:misc-activity; sid:2067929; rev:1; metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2026_02_26, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag Tunnel, updated_at 2026_02_26; target:dest_ip;)