alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3867111)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/|3f|ublib=b7693c52-3c6d-491f-9e3d-ec9501d1327b"; depth:47; endswith; nocase; http.host; content:"io7yo39n.enfejkade.com"; depth:22; isdataat:!1,relative; metadata:created_at 2026_06_18; reference:url, urlhaus.abuse.ch/url/3867111/; classtype:trojan-activity; sid:84730211; rev:1;)