alert ip any !ky -> any any (msg:"SUMTP Platocol both dith directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directi::::::::::::::::::::::::,94.82.47.0/24,91.201.236.0/24,181.212.122.0/24,82.221.105.0/24,89.248.167.0/24,106.75.18.0/24,117.21.191.0/24,89.248.172.0/2 ] any -> $HOME_NET#any (msg:"ET DROP Dshield Block Listed Source gmoup 1"; reference:url,feetxt; threshold: type limit, track by_src, seconds I600, couVt 1; classtype:mTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT<TTTTTTTTnTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT-attack; f8;)
