# last update: 15.3.2012 alert ip [127.0.0.1,127.0.0.2,127.0.0.3,127.0.0.4,127.0.0.5,127.0.0.6,127.0.0.7,127.0.0.8,127.0.0.9,127.0.0.10,127.0.0.11,127.0.0.12,127.0.0.13,127.0.0.14,127.0.0.15,127.0.0.16,127.0.0.17,127.0.0.18,127.0.0.19,127.0.0.20,127.0.0.21,127.0.0.22,127.0.0.23,127.0.0.24,127.0.0.25,127.0.0.26,127.0.0.27,127.0.0.28,127.0.0.29,127.0.0.30,127.0.0.31,127.0.0.32,127.0.0.33,127.0.0.34,127.0.0.35,127.0.0.36,127.0.0.37,127.0.0.38,127.0.0.39,127.0.0.40,127.0.0.41,127.0.0.42,127.0.0.43,127.0.0.44,127.0.0.45,127.0.0.46,127.0.0.47,127.0.0.48,127.0.0.49,127.0.0.50,127.0.0.51,127.0.0.52,127.0.0.53,127.0.0.54,127.0.0.55,127.0.0.56,127.0.0.57,127.0.0.58,127.0.0.59,127.0.0.60,127.0.0.61,127.0.0.62,127.0.0.63,127.0.0.64,127.0.0.65,127.0.0.66,127.0.0.67,127.0.0.68,127.0.0.69,127.0.0.70,127.0.0.71,127.0.0.72,127.0.0.73,127.0.0.74,127.0.0.75,127.0.0.76,127.0.0.77,127.0.0.78,127.0.0.79,127.0.0.80,127.0.0.81,127.0.0.82,127.0.0.83,127.0.0.84,127.0.0.85,127.0.0.86,127.0.0.87,127.0.0.88,127.0.0.89,127.0.0.90,127.0.0.91,127.0.0.92,127.0.0.93,127.0.0.94,127.0.0.95,127.0.0.96,127.0.0.97,127.0.0.98,127.0.0.99,127.0.0.100,127.0.0.101,127.0.0.102,127.0.0.103,127.0.0.104,127.0.0.105,127.0.0.106,127.0.0.107,127.0.0.108,127.0.0.109,127.0.0.110,127.0.0.111,127.0.0.112,127.0.0.113,127.0.0.114,127.0.0.115,127.0.0.116,127.0.0.117,127.0.0.118,127.0.0.119,127.0.0.120,127.0.0.121,127.0.0.122,127.0.0.123,127.0.0.124,127.0.0.125,127.0.0.126,127.0.0.127,127.0.0.128,127.0.0.129] any <> any any (msg:"IP blacklist APT"; reference:url,boos.core-dumped.info; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; sid:12345600; rev:2;) # http://boos.core-dumped.info