ET INFO Possible MSXMLHTTP Request to Dotted Quad

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET INFO Possible MSXMLHTTP Request to Dotted Quad";
    flow:to_server,established;
    flowbits:set,et.MS.XMLHTTP.ip.request;
    flowbits:noalert;
    http.start;
    content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Encoding|3a 20|gzip, deflate|0d 0a|User-Agent|3a 20|Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT"; fast_pattern;
    http.header_names;
    content:!"UA-CPU";
    content:!"Cookie";
    content:!"Referer";
    content:!"Accept-Language";
    http.host;
    pcre:"/^(?:\d{1,3}\.){3}\d{1,3}/";
    classtype:misc-activity;
    sid:2022054; rev:6;
    metadata:created_at 2015_11_10, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_17;
)