alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Python 🐍 urllib module 🌐"; flow:to_server, stateless; ja3.hash; content:"8d9f7747675e24454cd9b7ed35c58707"; fast_pattern; tls_sni; content:!"extensions.gnome.org"; endswith; nocase; content:!"api.shodan.io"; endswith; nocase; content:!"www.google-analytics.com"; nocase; endswith; content:!"ingest.sentry.io"; nocase; endswith; metadata:former_category JA3; reference:url,https://docs.python.org/fr/3/library/urllib.html; metadata:created_at 2021_08_25, updated_at 2024_06_05; sid:3300205; rev:7; classtype:policy-violation;)