alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NYU Internet Census UA Inbound"; flow:established,to_server; http.user_agent; content:"NYU Internet Census"; startswith; reference:url,scan.lol; classtype:network-scan; sid:2025461; rev:4; metadata:created_at 2018_04_03, deployment Perimeter, deployment Datacenter, confidence Medium, signature_severity Informational, updated_at 2024_04_13;)