alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3896332)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/cl/xytkjx7q1dal2bgntd9ws4rxd2jm6drs81i6p9oiabezdaou.hkbv4jowbgjmpug1r7lqfsw.yctlhgoryhj2sup3sfxpiv6xdccbg0rxrfrl7uhgfuoxto2my_is7qkqfe3qq9hi3lz8yxj6vnogu8mxreaxoa9fexd3dtakboplmzs2ywrhmscedns3nlzl3bu53l9rtzb6rmz2xwlslh_ypqfymfui0e7ac9xkg.c0r8~--qdlygjpqkgnky9es--_czsqbw_5cv2hhl6j7dr3w~~"; depth:288; endswith; nocase; http.host; content:"mt-link.jiosjcjp.club"; depth:21; isdataat:!1,relative; metadata:created_at 2026_08_03; reference:url, urlhaus.abuse.ch/url/3896332/; classtype:trojan-activity; sid:84759432; rev:1;)