reject tcp $HOME_NET any -> any 80 (msg:"tmp"; flow: to_server,established; uricontent:"popular/Teen/1.html"; content:"HOST: video-one.com"; nocase; http_header; react; sid:1000001; rev:1;)