alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO IP geo location service response"; flow:established,to_client; flowbits:isset,ETPRO.IP.geo.loc; http.cookie; content:"city_name="; fast_pattern; content:"state="; content:"country_"; content:"latitude="; content:"longitude="; file.data; content:"document.write(|22|"; startswith; reference:md5,0e2c46dc89dceb14e7add66cbfe8a2f8; classtype:policy-violation; sid:2014265; rev:6; metadata:created_at 2012_01_19, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_18;)