Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 13, 2026, 4:10 PM
THL Korean-ClaudeCode-Allowlist OpenClaw Distribution Domain TLS SNI (openclaw.ai)
alert tls $HOME_NET any -> any any (msg:"THL Korean-ClaudeCode-Allowlist OpenClaw Distribution Domain TLS SNI (openclaw.ai)"; tls.sni; content:"openclaw.ai"; nocase; startswith; endswith; threshold:type limit, track by_src, count 1, seconds 300 ; sid:3500041; rev:1; metadata:campaign Korean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104, created_at 2026_05_27, updated_at 2026_05_27;)
Metadata
campaignKorean-ClaudeCode-Allowlist-OpenClaw-221.150.15.104
created at2026_05_27
updated at2026_05_27
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!