alert tls any any -> $EXTERNAL_NET 443 (msg:"🐾 - ℹ RDAP request observed"; flow:to_server, stateless; tls.sni; content:"rdap."; startswith; metadata:reference:url, https://about.rdap.org/; metadata:created_at 2025_03_04, updated_at 2025_03_04; sid:3321419; rev:1; classtype:misc-activity;)