alert ip [27.255.85.0/24,31.56.209.0/24,31.57.184.0/24,31.57.216.0/24,31.76.32.0/24,31.129.49.0/24,31.217.252.0/24,31.222.236.0/24,36.0.8.0/21,36.0.128.0/17,36.37.48.0/20,36.116.0.0/16,36.119.0.0/16,36.255.97.0/24,36.255.98.0/24,36.255.216.0/22,36.255.236.0/22,37.49.148.0/24,37.72.140.0/24,37.77.150.0/24] any -> $HOME_NET any (msg:"ET DROP Spamhaus DROP Listed Traffic Inbound group 3"; reference:url,www.spamhaus.org/drop/drop.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DROPIP; sid:2400002; rev:4770; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Dshield, signature_severity Minor, created_at 2010_12_30, updated_at 2026_07_16;)