##alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED FAKEAV Gemini - JavaScript? Redirection To FakeAV? Binary"; flow:established,to_client; content:"