alert ip [45.33.41.0/24,66.132.186.0/24,151.243.11.0/24,65.49.1.0/24,66.132.172.0/24,162.217.100.0/24,198.235.24.0/24,45.198.224.0/24,64.62.197.0/24,94.154.43.0/24,199.45.154.0/24,64.62.156.0/24,193.163.125.0/24,45.205.1.0/24,66.240.223.0/24,91.92.40.0/24,167.94.145.0/24,213.209.159.0/24,205.210.31.0/24,91.231.89.0/24] any -> $HOME_NET any (msg:"ET DROP Dshield Block Listed Source group 1"; reference:url,feeds.dshield.org/block.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DshieldIP; sid:2402000; rev:7802; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Dshield, signature_severity Major, created_at 2010_12_30, updated_at 2026_07_16;)