alert ip [188.124.50.0/24,188.172.160.0/20,188.190.10.0/24,188.208.48.0/22,188.208.52.0/22,188.213.23.0/24,188.213.206.0/23,188.213.214.0/23,188.213.248.0/22,188.213.252.0/22,188.214.140.0/24,188.214.155.0/24,188.214.193.0/24,188.240.14.0/24,188.241.177.0/24,188.247.230.0/24,190.168.128.0/18,190.168.192.0/18,190.185.108.0/22,191.101.31.0/24] any -> $HOME_NET any (msg:"ET DROP Spamhaus DROP Listed Traffic Inbound group 40"; reference:url,www.spamhaus.org/drop/drop.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DROPIP; sid:2400039; rev:4770; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Dshield, signature_severity Minor, created_at 2010_12_30, updated_at 2026_07_16;)