alert tcp [102.130.117.167,102.130.127.117,102.206.117.134,102.211.56.112,102.211.56.20,102.31.238.55,103.109.101.105,103.109.187.71,103.146.203.11,103.146.203.14] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node Traffic group 1"; reference:url,check.torproject.org/torbulkexitlist; threshold:type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520000; rev:6267; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2026_05_27;)