Rule History

SID: 2522574 • Source: et/open

Versions (491)

Version DetailsCurrent

Rev: 6267 • Dec 1, 2008, 12:00 PM

Message:

ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 575

Rule:

alert tcp [64.65.62.218,64.65.62.219,64.65.62.22,64.65.62.220,64.65.62.221,64.65.62.222,64.65.62.223,64.65.62.224,64.65.62.225,64.65.62.226] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 575"; reference:url,www.dan.me.uk/torlist/; threshold:type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522574; rev:6267; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2026_05_27;)

Created:

Dec 1, 2008, 12:00 PM

Updated:

May 27, 2026, 12:00 PM

DB Created:

Jun 27, 2025, 8:34 PM

DB Updated:

May 27, 2026, 9:21 PM

Filename:

rules/tor.rules