Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM
THL Korean-ClaudeCode-Allowlist Operator Open Directory Access (221.150.15.104:8080)
alert http $HOME_NET any -> 221.150.15.104 any (msg:"THL Korean-ClaudeCode-Allowlist Operator Open Directory Access (221.150.15.104:8080)" ; http.host; content:"221.150.15.104"; bsize:14; http.method; content:"GET"; threshold:type limit, track by_src, count 1, seconds 3600 ; sid:1900034; rev:1; metadata:campaign Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104, created_at 2026_05_27, updated_at 2026_05_27;)
Metadata
campaignKorean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104
created at2026_05_27
updated at2026_05_27
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!