alert ip [31.129.49.0/24,31.217.252.0/24,31.222.236.0/24,36.0.8.0/21,36.0.128.0/17,36.37.48.0/20,36.116.0.0/16,36.119.0.0/16,36.255.97.0/24,36.255.98.0/24,36.255.216.0/22,36.255.236.0/22,37.49.148.0/24,37.72.140.0/24,37.77.150.0/24,37.140.251.0/24,37.156.64.0/23,38.18.13.0/24,38.92.184.0/21,38.107.120.0/21] any -> $HOME_NET any (msg:"ET DROP Spamhaus DROP Listed Traffic Inbound group 3"; reference:url,www.spamhaus.org/drop/drop.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DROPIP; sid:2400002; rev:4719; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Dshield, signature_severity Minor, created_at 2010_12_30, updated_at 2026_05_26;)