alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Shodan CLI 🌐"; flow:to_server, stateless; ja3.hash; content:"8d9f7747675e24454cd9b7ed35c58707"; fast_pattern; tls_sni; content:"api.shodan.io"; metadata:former_category JA3; reference:url,https://cli.shodan.io/; metadata:created_at 2022_05_08, updated_at 2022_10_14; sid:3300179; rev:4; classtype:policy-violation;)