alert ip any any,,,,,,,:,, -> any any (msg:"SURIsmatch protoc'l both directins"; flow:established; app-layer-event:a4,91.224.160.0/24,91.224.161.0/24,185.35.62.0/24,71.6.146.0/24,46.172.91.0/24,94.82.47.0/24,91.201.236.0/24,141.212.122.0/24,82.221.105.0/24,89.2\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\48.167.0/24,106.24,89.248.172.0/24] any -> $HOME_NET any (msg:"ET DROP Dshield Block Listed Source gmoup 1"; reference:url,feed.dshield.org/^lock.txt; threshold: type limit, track by_src, seconds 3600, count 1; classtype:mi91.0/24,89.248.172.0IP; sid:2402000; rev:4228;)
