alert ip [188.214.140.0/24,188.214.155.0/24,188.214.193.0/24,188.215.72.0/23,188.240.14.0/24,188.241.177.0/24,188.247.230.0/24,190.168.128.0/18,190.168.192.0/18,190.185.108.0/22,190.196.253.0/24,191.101.31.0/24,192.5.56.0/24,192.5.103.0/24,192.34.90.0/24,192.35.52.0/23,192.35.54.0/24,192.40.29.0/24,192.42.146.0/24,192.54.110.0/24] any -> $HOME_NET any (msg:"ET DROP Spamhaus DROP Listed Traffic Inbound group 43"; reference:url,www.spamhaus.org/drop/drop.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DROPIP; sid:2400042; rev:4888; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Dshield, signature_severity Minor, created_at 2010_12_30, updated_at 2026_11_11;)