This repository was archived by the owner on Mar 17, 2026. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathciarmy.rules
More file actions
134 lines (134 loc) · 108 KB
/
Copy pathciarmy.rules
File metadata and controls
134 lines (134 loc) · 108 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
#
# $Id: emerging-ciarmy.rules $
# Emerging Threats Ciarmy rules.
#
# Rules to block CiArmy.com identified Top Attackers (www.ciarmy.com)
#
# More information available at www.emergingthreats.net
#
# Please submit any feedback or ideas to emerging@emergingthreats.net or the emerging-sigs mailing list
#
#*************************************************************
#
# Copyright (c) 2003-2019, Emerging Threats
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
# following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
# disclaimer.
# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
# following disclaimer in the documentation and/or other materials provided with the distribution.
# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
alert ip [1.11.100.135,1.168.120.198,1.171.10.247,1.171.145.253,1.173.225.177,1.174.25.6,1.174.74.150,1.179.128.124,1.179.153.18,1.179.173.2,1.179.199.114,1.186.220.253,1.188.193.211,1.189.79.7,1.189.88.70,1.192.131.153,1.192.192.4,1.192.192.6,1.192.192.8,1.192.195.11,1.192.195.5,1.192.195.8,1.193.112.135,1.196.216.140,1.202.128.68,1.202.156.201,1.202.240.163,1.203.115.140,1.203.115.64,1.203.161.58,1.203.65.156,1.203.80.2,1.203.93.254,1.207.63.62,1.209.72.151,1.209.72.154,1.214.245.27,1.222.141.242,1.224.166.120,1.224.166.240,1.227.37.35,1.227.5.115,1.231.158.6,1.238.61.87,1.243.12.150,1.245.218.13,1.245.248.204,1.249.31.138,1.250.176.173,1.250.176.181] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 1"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403300; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [1.250.239.46,1.252.1.43,1.26.137.149,1.29.26.230,1.31.92.70,1.32.238.18,1.32.249.100,1.32.249.34,1.34.0.39,1.34.129.14,1.34.140.51,1.34.143.172,1.34.160.50,1.34.161.7,1.34.171.205,1.34.174.109,1.34.179.172,1.34.194.23,1.34.197.179,1.34.213.33,1.34.217.33,1.34.27.155,1.34.83.79,1.34.96.239,1.36.105.88,1.36.167.137,1.36.21.130,1.36.56.102,1.4.181.133,1.4.191.230,1.52.134.44,1.52.29.73,1.52.58.248,1.53.147.235,1.53.252.17,1.53.32.201,1.54.221.9,1.55.252.180,1.56.207.130,1.56.207.131,1.62.117.4,1.63.10.177,1.63.226.82,1.63.3.16,1.64.108.180,1.64.109.147,1.64.132.68,1.64.144.195,1.64.189.213,1.64.189.27] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 2"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403301; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [1.64.51.155,1.65.131.209,1.65.139.180,1.65.152.196,1.65.157.99,1.69.204.36,1.69.76.210,1.71.191.178,2.110.41.186,2.132.171.171,2.132.249.34,2.133.85.228,2.135.237.28,2.136.161.213,2.136.165.103,2.136.182.204,2.136.191.82,2.136.64.237,2.180.28.2,2.180.31.138,2.180.37.80,2.180.8.67,2.207.135.70,2.226.152.75,2.227.228.222,2.229.110.184,2.229.123.30,2.232.146.200,2.235.159.160,2.237.163.161,2.237.2.161,2.237.250.31,2.237.6.173,2.238.148.8,2.238.32.42,2.239.139.239,2.249.177.216,2.32.26.67,2.35.104.118,2.35.179.41,2.36.218.122,2.38.157.22,2.38.184.254,2.38.185.198,2.39.173.31,2.39.238.49,2.42.14.41,2.42.207.248,2.45.240.226,2.47.113.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 3"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403302; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [2.47.179.38,2.47.198.217,2.50.125.47,2.50.157.136,2.50.168.44,2.50.182.81,2.50.34.1,2.58.228.167,2.59.146.22,2.61.248.243,2.61.251.97,2.81.219.150,2.85.44.52,2.86.68.151,3.135.249.67,3.231.147.49,3.80.170.246,3.81.60.82,3.89.212.33,3.90.178.48,3.94.250.69,3.95.32.131,4.34.133.66,5.100.61.211,5.101.0.209,5.102.58.45,5.11.71.7,5.129.145.176,5.129.14.77,5.133.168.15,5.135.120.247,5.135.253.172,5.140.165.39,5.14.229.170,5.149.223.181,5.15.241.55,5.151.118.100,5.151.13.157,5.152.207.195,5.159.228.68,5.164.31.236,5.172.189.138,5.172.25.16,5.180.76.156,5.182.211.152,5.182.211.180,5.182.211.181,5.182.211.184,5.183.101.155,5.183.181.86] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 4"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403303; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [5.187.160.235,5.187.211.214,5.188.210.158,5.188.210.190,5.189.131.63,5.189.134.204,5.189.148.136,5.189.167.107,5.189.23.195,5.19.235.186,5.196.30.151,5.199.145.92,5.200.64.54,5.200.77.90,5.2.202.88,5.21.60.124,5.219.45.176,5.233.47.124,5.253.16.121,5.32.68.226,5.32.86.98,5.34.179.23,5.39.200.102,5.39.216.148,5.42.118.38,5.44.197.24,5.44.206.147,5.56.27.145,5.57.249.2,5.65.112.9,5.79.193.51,5.79.82.19,5.81.76.102,5.88.122.58,5.88.130.165,5.89.112.6,5.89.175.250,5.89.59.163,5.95.35.109,5.95.73.175,8.208.16.219,8.208.80.126,8.209.67.241,8.209.78.24,8.3.127.247,8.42.79.215,11.11.3.191,12.156.112.9,12.166.193.125,12.178.187.6] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 5"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403304; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [12.178.187.7,12.178.187.8,12.178.187.9,12.188.20.242,12.192.164.250,12.197.133.114,12.203.180.37,12.208.103.106,12.21.84.50,12.221.234.155,12.235.36.252,12.34.218.243,12.36.54.66,12.88.142.206,13.230.186.61,13.65.201.223,13.71.92.210,14.10.34.1,14.102.254.230,14.102.30.118,14.102.71.10,14.116.160.67,14.116.188.151,14.117.184.202,14.127.251.189,14.128.34.34,14.136.134.20,14.136.175.3,14.136.211.137,14.136.249.138,14.136.249.140,14.136.49.112,14.136.80.242,14.139.110.164,14.139.171.130,14.141.111.154,14.141.64.104,14.141.67.86,14.143.114.163,14.152.100.147,14.161.0.218,14.161.10.81,14.161.1.251,14.161.13.217,14.161.31.125,14.161.32.108,14.161.32.122,14.161.42.135,14.161.46.100,14.161.4.63] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 6"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403305; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [14.164.26.111,14.168.143.170,14.17.100.33,14.17.100.57,14.17.114.65,14.173.230.52,14.176.232.103,14.177.232.175,14.177.236.108,14.18.118.232,14.18.248.3,14.181.74.160,14.184.112.26,14.186.161.148,14.186.57.130,14.188.164.230,14.189.228.78,14.191.11.163,14.191.211.188,14.192.240.143,14.198.135.180,14.198.46.23,14.202.114.24,14.204.211.122,14.207.101.13,14.207.113.190,14.21.18.57,14.21.85.18,14.225.19.81,14.227.84.0,14.230.47.222,14.23.37.162,14.23.50.218,14.231.178.198,14.231.93.166,14.232.155.94,14.232.160.2,14.232.208.115,14.232.208.235,14.232.245.36,14.237.142.62,14.237.218.171,14.238.7.6,14.241.231.79,14.241.251.217,14.241.67.202,14.248.114.236,14.253.173.76,14.255.71.90,14.29.137.186] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 7"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403306; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [14.29.184.152,14.29.214.3,14.29.244.7,14.33.211.12,14.33.212.145,14.33.35.138,14.34.189.136,14.34.227.102,14.35.19.181,14.36.117.15,14.36.163.165,14.37.10.144,14.38.133.217,14.39.208.75,14.39.246.130,14.40.63.243,14.42.155.38,14.42.33.245,14.42.74.230,14.42.80.24,14.43.173.208,14.44.96.65,14.44.97.33,14.45.132.44,14.45.175.87,14.46.40.196,14.46.81.47,14.47.20.195,14.47.77.176,14.48.97.168,14.49.135.191,14.5.165.7,14.52.111.32,14.53.193.76,14.53.43.12,14.54.113.164,14.54.176.243,14.55.144.142,14.78.109.175,15.165.76.150,18.188.244.162,18.206.180.29,18.219.102.7,18.219.134.226,18.224.116.199,18.232.60.254,18.232.98.238,20.1.2.2,20.42.105.91,23.108.217.156] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 8"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403307; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [23.113.104.137,23.116.185.114,23.160.192.87,23.224.37.18,23.225.148.210,23.226.54.2,23.228.238.156,23.231.25.234,23.234.14.159,23.234.51.226,23.234.52.210,23.236.76.45,23.239.5.151,23.24.170.173,23.241.142.52,23.244.43.90,23.244.53.2,23.245.26.252,23.248.188.94,23.251.84.126,23.252.41.74,23.30.163.61,23.30.53.161,23.30.63.253,23.31.209.205,23.88.137.2,23.89.251.218,23.89.88.2,23.94.122.108,23.94.173.238,23.94.179.104,23.94.182.210,23.95.191.195,23.95.8.16,24.106.125.38,24.106.36.242,24.106.36.74,24.111.179.6,24.118.95.131,24.119.52.56,24.129.157.58,24.129.170.35,24.132.92.8,24.136.3.188,24.149.10.29,24.165.25.22,24.181.67.58,24.182.196.46,24.184.79.176,24.186.140.196] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 9"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403308; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [24.187.199.142,24.188.5.96,24.193.135.2,24.200.159.124,24.203.3.167,24.206.4.29,24.209.156.27,24.212.15.149,24.212.240.29,24.213.8.101,24.217.116.164,24.220.73.91,24.224.145.161,24.232.235.120,24.234.48.230,24.244.144.145,24.38.235.234,24.41.166.50,24.42.143.162,24.42.19.24,24.42.229.143,24.42.240.210,24.42.55.108,24.64.194.214,24.7.156.134,24.84.159.15,24.87.132.29,24.93.200.253,24.96.155.223,24.96.212.159,24.97.43.195,27.102.129.22,27.104.193.30,27.104.228.249,27.105.198.188,27.109.137.192,27.109.186.79,27.111.36.254,27.113.3.47,27.113.68.229,27.115.124.10,27.115.124.74,27.115.124.75,27.115.124.9,27.115.252.189,27.116.126.169,27.116.18.109,27.116.38.166,27.12.12.217,27.124.2.123] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 10"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403309; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [27.13.237.18,27.13.96.23,27.131.178.119,27.142.249.93,27.147.142.53,27.147.40.16,27.151.0.205,27.151.29.191,27.151.29.56,27.154.69.10,27.155.83.174,27.155.87.178,27.159.122.176,27.17.35.34,27.188.208.8,27.189.251.228,27.191.150.46,27.193.249.146,27.197.61.153,27.198.10.136,27.199.156.212,27.208.235.148,27.209.161.166,27.214.109.125,27.215.59.76,27.221.25.235,27.223.107.146,27.223.90.210,27.223.94.122,27.252.53.160,27.252.57.41,27.254.130.97,27.254.174.209,27.254.34.181,27.254.64.87,27.254.67.162,27.255.40.150,27.3.135.30,27.3.178.12,27.35.18.93,27.38.37.76,27.48.138.8,27.49.160.7,27.49.160.8,27.49.160.9,27.49.232.7,27.49.232.9,27.49.64.14,27.50.25.211,27.68.103.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 11"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403310; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [27.68.39.70,27.71.138.41,27.72.102.234,27.72.103.62,27.72.104.175,27.72.105.47,27.72.148.10,27.72.149.73,27.72.164.185,27.72.164.250,27.72.74.143,27.72.80.126,27.72.88.125,27.72.95.38,27.73.111.77,27.74.139.193,27.74.241.170,27.74.242.47,27.74.245.44,27.74.251.241,27.74.254.2,27.75.114.243,27.75.208.78,27.75.43.10,27.76.200.188,27.76.200.86,27.76.247.30,27.77.137.79,27.77.188.213,27.78.186.44,27.78.26.72,27.78.87.109,27.8.192.209,27.8.4.208,27.92.117.238,31.129.70.189,31.129.82.101,31.13.131.138,31.13.32.226,31.133.207.227,31.134.209.80,31.134.32.52,31.135.30.132,31.14.136.214,31.14.139.155,31.14.16.248,31.14.184.2,31.146.84.142,31.156.217.180,31.156.70.28] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 12"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403311; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [31.163.129.85,31.163.130.200,31.163.132.182,31.163.146.178,31.163.146.217,31.163.154.80,31.163.157.230,31.163.159.196,31.163.160.113,31.163.160.180,31.163.163.127,31.163.163.97,31.163.164.228,31.163.168.9,31.163.169.25,31.163.170.170,31.163.175.70,31.163.176.22,31.163.177.156,31.163.180.66,31.163.184.200,31.163.184.216,31.168.184.82,31.171.69.250,31.172.178.181,31.173.125.143,31.186.48.172,31.207.45.90,31.207.47.48,31.208.133.145,31.208.166.61,31.208.190.94,31.208.193.240,31.208.204.215,31.208.235.134,31.208.252.216,31.23.165.126,31.25.132.230,31.25.90.227,31.27.149.45,31.28.238.187,31.31.72.164,31.31.75.212,31.31.91.111,31.42.165.227,31.47.43.139,31.5.167.62,34.203.222.103,34.207.73.231,34.229.187.158] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 13"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403312; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [34.67.254.99,34.68.217.179,34.69.48.89,34.71.232.44,34.71.95.229,34.80.135.20,34.80.153.175,34.80.51.84,34.80.83.131,34.82.202.253,34.84.185.118,34.84.82.184,34.85.95.77,34.85.97.252,34.87.165.209,34.87.24.216,34.87.95.122,34.89.122.124,34.90.159.83,34.91.64.196,34.92.115.242,34.92.255.52,34.92.31.13,34.92.63.3,34.93.85.18,34.94.204.192,34.94.225.64,34.95.150.205,34.95.252.156,34.96.133.169,34.96.166.35,34.96.217.139,34.96.247.114,35.175.255.49,35.188.62.96,35.189.42.166,35.197.203.96,35.197.227.71,35.203.51.216,35.203.85.214,35.220.130.113,35.220.169.26,35.220.206.213,35.220.210.160,35.222.233.6,35.222.24.235,35.228.13.240,35.228.174.126,35.229.214.34,35.229.216.125] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 14"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403313; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [35.234.74.221,35.234.82.66,35.236.148.112,35.239.182.3,35.240.157.102,35.241.72.43,35.243.218.129,36.103.229.37,36.103.241.148,36.104.145.203,36.108.168.81,36.110.105.52,36.110.182.30,36.110.218.194,36.110.218.196,36.110.3.50,36.110.41.66,36.110.44.187,36.110.64.84,36.111.150.124,36.112.101.130,36.112.138.185,36.112.26.54,36.112.41.194,36.112.66.234,36.153.221.82,36.153.23.162,36.153.23.163,36.153.23.168,36.153.23.171,36.153.23.184,36.153.23.186,36.154.117.210,36.154.8.19,36.22.187.34,36.225.98.68,36.228.87.231,36.233.65.79,36.236.10.142,36.237.11.188,36.237.204.40,36.248.182.205,36.250.75.44,36.251.182.193,36.255.220.125,36.255.223.102,36.26.134.125,36.26.64.143,36.27.79.124,36.33.140.46] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 15"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403314; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [36.33.94.86,36.37.115.106,36.38.59.139,36.41.184.69,36.46.136.67,36.48.159.58,36.48.166.77,36.52.213.123,36.66.133.87,36.66.249.242,36.66.76.165,36.67.167.19,36.67.205.67,36.67.206.55,36.67.88.27,36.7.175.187,36.7.80.168,36.7.82.194,36.7.87.6,36.72.129.148,36.72.217.50,36.85.86.187,36.89.232.235,36.89.251.105,36.91.123.210,36.91.175.212,36.92.18.191,36.92.92.42,37.104.160.145,37.105.131.203,37.105.238.187,37.106.170.150,37.106.175.35,37.11.74.18,37.112.157.251,37.116.253.122,37.117.129.128,37.120.146.76,37.120.249.77,37.130.119.63,37.131.208.141,37.131.222.41,37.139.105.177,37.139.99.58,37.144.102.164,37.156.146.132,37.156.147.69,37.159.137.186,37.17.250.101,37.179.145.116] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 16"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403315; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [37.189.3.63,37.191.192.155,37.191.197.157,37.191.232.6,37.193.119.50,37.193.123.110,37.193.123.141,37.193.175.55,37.193.216.194,37.203.147.147,37.203.156.214,37.203.175.66,37.206.130.116,37.208.66.110,37.224.21.161,37.224.21.163,37.224.22.243,37.228.137.243,37.228.65.237,37.229.72.49,37.229.85.211,37.232.180.177,37.233.53.184,37.233.55.0,37.233.60.56,37.235.186.160,37.235.86.14,37.235.87.163,37.238.136.74,37.252.65.22,37.252.69.104,37.252.69.119,37.252.86.62,37.252.87.15,37.255.187.200,37.255.197.241,37.255.197.65,37.26.2.122,37.26.9.108,37.28.161.146,37.29.110.183,37.29.82.227,37.32.46.25,37.34.187.254,37.34.228.1,37.34.245.237,37.46.33.146,37.49.225.166,37.49.226.107,37.49.226.111] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 17"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403316; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [37.49.226.117,37.49.226.118,37.49.226.132,37.49.226.133,37.49.226.134,37.49.226.135,37.49.226.141,37.49.226.16,37.49.226.160,37.49.226.161,37.49.226.241,37.49.226.250,37.49.226.3,37.49.226.4,37.49.226.7,37.49.227.109,37.49.230.14,37.49.230.180,37.49.231.145,37.52.68.220,37.53.232.164,37.54.213.187,37.55.70.27,37.6.248.104,37.72.0.205,37.79.142.65,37.79.255.19,38.109.112.81,38.112.61.248,38.117.105.179,38.123.196.230,38.65.250.6,38.69.233.7,38.83.107.236,39.100.115.10,39.100.224.53,39.104.163.128,39.104.21.120,39.106.67.100,39.106.89.199,39.109.114.159,39.109.202.126,39.109.223.10,39.112.101.126,39.113.197.251,39.113.202.40,39.118.111.86,39.119.230.52,39.129.118.30,39.134.26.20] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 18"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403317; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [39.150.61.109,39.152.57.62,39.153.135.16,39.153.252.196,39.155.137.126,39.155.222.2,39.164.161.51,39.164.205.16,39.37.200.193,39.42.57.234,39.46.13.184,39.61.33.16,39.69.190.90,39.69.95.38,39.76.234.10,39.77.25.187,39.77.70.12,39.86.189.230,39.88.153.105,39.90.78.82,39.96.56.35,39.98.200.82,39.98.75.99,40.118.1.129,40.132.4.75,40.69.191.102,40.71.206.241,41.110.24.21,41.128.168.39,41.129.43.88,41.138.57.244,41.138.88.26,41.139.12.151,41.139.248.45,41.140.253.4,41.149.156.93,41.155.244.120,41.160.231.12,41.162.61.106,41.170.93.142,41.189.186.163,41.204.84.182,41.208.73.21,41.21.233.230,41.21.238.5,41.213.192.168,41.218.224.119,41.219.185.234,41.221.251.19,41.221.52.130] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 19"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403318; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [41.222.232.227,41.224.249.60,41.225.58.25,41.226.32.137,41.230.32.213,41.32.124.181,41.32.133.153,41.32.153.100,41.32.17.167,41.32.187.131,41.33.146.1,41.33.188.148,41.33.210.78,41.33.240.117,41.33.37.150,41.38.121.79,41.38.165.34,41.38.50.50,41.39.49.181,41.39.53.198,41.39.55.49,41.41.153.43,41.41.186.99,41.41.5.10,41.41.71.195,41.41.77.196,41.59.251.246,41.59.82.140,41.63.8.13,41.65.182.136,41.65.218.72,41.65.68.70,41.72.61.43,41.73.3.190,41.75.81.26,41.75.86.18,41.76.168.83,41.76.169.8,41.76.8.12,41.78.172.77,41.78.26.18,41.79.196.246,41.82.189.133,41.82.224.162,41.89.198.249,41.92.133.214,41.93.40.87,42.101.48.131,42.102.144.81,42.113.90.187] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 20"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403319; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [42.115.148.209,42.115.193.128,42.115.250.31,42.115.32.189,42.115.52.206,42.116.29.44,42.117.168.210,42.117.197.240,42.117.69.246,42.119.204.235,42.119.29.161,42.123.99.67,42.157.162.14,42.179.128.214,42.179.94.31,42.187.123.122,42.189.17.22,42.200.129.185,42.200.137.178,42.200.198.230,42.200.236.169,42.2.158.161,42.2.48.166,42.2.65.112,42.202.133.2,42.224.86.170,42.225.178.117,42.226.125.107,42.228.2.150,42.228.58.107,42.230.123.198,42.230.207.98,42.235.149.100,42.236.10.112,42.236.10.72,42.236.73.90,42.236.74.70,42.236.82.143,42.236.82.184,42.236.91.186,42.237.60.193,42.247.16.101,42.247.5.68,42.247.5.71,42.247.5.75,42.247.5.76,42.247.5.80,42.247.5.84,42.247.5.87,42.247.5.93] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 21"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403320; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [42.247.7.169,42.249.8.118,42.3.141.166,42.3.4.55,42.4.0.212,42.4.253.79,42.48.104.96,42.48.60.89,42.51.223.101,42.51.223.103,42.51.225.175,42.51.64.190,42.55.69.77,42.58.181.106,42.62.107.209,42.62.18.252,42.62.2.130,42.62.24.243,42.62.96.36,42.81.122.86,42.81.123.232,42.81.142.146,42.82.237.144,42.82.237.8,42.84.201.65,42.98.194.98,42.98.51.170,43.224.180.205,43.224.252.233,43.225.159.106,43.225.167.166,43.226.35.167,43.226.49.116,43.226.49.84,43.226.67.8,43.228.38.174,43.228.79.13,43.228.79.40,43.228.79.41,43.228.79.43,43.230.144.10,43.230.144.22,43.230.144.66,43.230.146.191,43.231.185.29,43.240.10.72,43.240.117.208,43.240.117.223,43.240.136.228,43.240.137.16] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 22"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403321; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [43.241.110.15,43.241.111.41,43.242.214.183,43.242.34.38,43.243.136.253,43.243.168.63,43.243.168.98,43.245.222.163,43.245.222.176,43.245.222.88,43.245.234.76,43.246.174.220,43.246.175.119,43.247.184.225,43.247.184.39,43.247.68.12,43.248.124.113,43.250.106.18,43.250.186.190,43.250.186.82,43.250.187.166,43.250.187.22,43.250.80.170,43.252.195.66,43.252.66.131,43.254.213.71,43.254.240.150,43.254.240.34,43.255.217.140,45.112.247.15,45.113.68.179,45.113.69.175,45.113.70.144,45.113.70.223,45.113.70.231,45.113.70.37,45.113.71.101,45.113.71.103,45.113.71.200,45.113.71.209,45.113.71.23,45.113.71.236,45.114.10.158,45.114.85.202,45.115.236.30,45.115.243.34,45.116.160.31,45.116.191.172,45.117.176.23,45.117.42.125] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 23"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403322; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.119.82.251,45.121.144.114,45.121.144.203,45.122.138.23,45.122.221.69,45.122.246.127,45.122.246.176,45.122.46.2,45.123.97.24,45.123.97.25,45.124.19.82,45.125.217.193,45.125.218.10,45.125.44.134,45.125.65.74,45.125.66.204,45.126.121.75,45.127.133.94,45.127.134.32,45.127.186.21,45.127.96.75,45.127.96.99,45.127.97.45,45.127.97.47,45.130.2.198,45.13.93.82,45.13.93.90,45.134.179.243,45.134.179.57,45.134.179.87,45.134.179.88,45.134.217.139,45.135.236.2,45.136.108.35,45.136.108.85,45.136.109.251,45.14.150.133,45.14.150.52,45.141.85.106,45.141.87.24,45.143.220.112,45.143.220.125,45.143.220.127,45.143.220.133,45.143.220.134,45.143.220.138,45.143.220.140,45.143.220.146,45.143.220.152,45.143.220.18] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 24"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403323; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.143.220.213,45.143.220.231,45.143.220.235,45.143.220.28,45.143.220.48,45.143.222.107,45.143.223.158,45.143.223.21,45.148.10.141,45.148.10.160,45.148.10.64,45.149.206.194,45.150.140.125,45.161.109.35,45.162.158.246,45.163.149.29,45.164.180.78,45.166.154.242,45.167.144.11,45.167.250.19,45.167.95.134,45.169.16.15,45.173.5.38,45.173.5.45,45.176.193.220,45.176.240.44,45.181.170.133,45.182.156.3,45.220.68.91,45.220.84.240,45.220.87.59,45.225.120.21,45.225.236.190,45.227.255.190,45.228.101.185,45.228.12.138,45.229.102.56,45.230.7.14,45.232.5.10,45.233.14.64,45.233.252.25,45.234.77.114,45.235.94.120,45.238.208.3,45.238.244.8,45.240.103.191,45.248.168.86,45.250.239.64,45.251.32.225,45.251.52.6] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 25"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403324; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.252.245.239,45.253.64.112,45.253.64.90,45.254.25.62,45.254.26.171,45.33.50.100,45.33.7.49,45.33.84.29,45.44.10.76,45.55.179.132,45.55.235.30,45.55.32.34,45.55.38.39,45.55.55.17,45.55.65.92,45.55.88.16,45.55.92.115,45.56.125.203,45.56.127.149,45.56.91.118,45.56.91.156,45.58.189.232,45.59.238.186,45.6.39.121,45.61.136.154,45.62.248.24,45.65.215.173,45.70.216.74,45.7.133.45,45.7.209.135,45.73.13.205,45.77.254.120,45.77.254.20,45.78.181.194,45.79.103.8,45.79.106.170,45.79.110.218,45.79.209.188,45.79.213.51,45.79.32.56,45.80.252.49,45.84.221.142,45.88.104.99,45.88.179.138,45.88.43.178,45.9.46.201,45.95.168.131,45.95.168.145,45.95.168.162,45.95.168.245] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 26"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403325; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.95.168.96,45.95.168.98,46.100.62.185,46.101.100.227,46.101.132.40,46.101.149.23,46.101.158.75,46.101.171.183,46.101.197.111,46.101.199.196,46.101.201.69,46.101.206.205,46.101.211.160,46.101.223.54,46.101.231.203,46.101.33.198,46.101.6.56,46.101.94.224,46.102.13.112,46.102.171.211,46.102.175.102,46.102.175.105,46.105.112.86,46.105.130.242,46.105.130.246,46.105.130.249,46.105.132.32,46.11.163.174,46.116.99.64,46.13.24.145,46.145.188.106,46.146.242.149,46.146.245.28,46.148.20.25,46.149.32.122,46.150.5.9,46.151.192.226,46.151.40.201,46.151.9.29,46.152.141.237,46.152.53.188,46.161.27.75,46.161.53.51,46.17.121.109,46.171.210.134,46.172.223.236,46.172.70.240,46.173.208.2,46.173.4.36,46.174.191.28] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 27"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403326; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [46.174.191.29,46.174.191.30,46.174.191.31,46.174.191.32,46.180.192.253,46.183.112.72,46.184.61.226,46.185.128.230,46.185.162.140,46.185.78.20,46.199.64.22,46.201.164.152,46.209.117.210,46.209.209.74,46.214.240.164,46.214.60.29,46.219.113.59,46.22.224.50,46.221.12.194,46.224.1.114,46.225.129.84,46.225.242.41,46.233.12.29,46.233.4.150,46.233.58.39,46.24.44.151,46.243.179.136,46.249.91.100,46.25.243.48,46.253.1.246,46.253.95.33,46.254.128.140,46.28.121.134,46.32.250.216,46.32.250.31,46.33.251.77,46.36.132.23,46.36.132.83,46.37.222.227,46.37.24.221,46.38.47.184,46.39.28.44,46.52.188.27,46.55.208.54,46.59.17.98,46.65.103.222,46.70.16.106,46.71.235.110,46.8.173.223,46.99.140.112] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 28"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403327; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [46.99.158.243,46.99.158.80,46.99.251.244,47.138.120.140,47.144.85.62,47.152.60.28,47.180.190.49,47.180.63.200,47.190.36.218,47.196.141.175,47.205.162.158,47.205.35.212,47.206.131.151,47.206.50.173,47.21.134.156,47.240.48.109,47.240.74.5,47.240.81.166,47.241.36.60,47.241.37.106,47.241.68.247,47.241.77.254,47.244.170.197,47.244.21.47,47.244.9.191,47.254.131.234,47.254.148.130,47.254.151.244,47.254.155.71,47.254.184.183,47.34.128.122,47.39.92.151,47.41.49.211,47.44.200.174,47.46.200.83,47.48.235.158,47.52.228.224,47.52.61.206,47.52.64.165,47.52.93.164,47.53.162.96,47.56.181.206,47.56.217.238,47.57.117.233,47.74.224.215,47.74.241.65,47.74.252.116,47.74.255.15,47.75.11.17,47.75.130.193] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 29"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403328; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [47.75.131.71,47.75.140.137,47.75.14.134,47.75.143.123,47.75.148.197,47.75.158.222,47.75.166.1,47.75.190.215,47.75.199.183,47.75.207.187,47.75.47.51,47.75.74.11,47.90.104.221,47.90.19.167,47.90.75.80,47.90.96.169,47.91.146.131,47.91.89.6,47.92.72.19,47.92.85.98,47.94.233.116,47.98.245.155,49.0.76.72,49.128.174.248,49.128.36.34,49.142.102.191,49.142.196.36,49.142.223.68,49.142.82.60,49.143.156.226,49.143.180.12,49.143.185.217,49.143.187.215,49.143.32.6,49.147.124.188,49.159.20.138,49.159.23.18,49.160.7.152,49.164.92.52,49.167.185.78,49.167.5.162,49.175.229.51,49.175.229.54,49.176.209.149,49.194.56.232,49.204.89.226,49.206.26.9,49.207.12.162,49.213.163.179,49.213.163.198] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 30"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403329; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [49.213.171.67,49.213.173.147,49.213.173.225,49.213.178.207,49.213.180.50,49.213.183.50,49.213.184.137,49.213.212.172,49.213.213.152,49.229.29.50,49.231.146.68,49.231.35.39,49.231.66.20,49.232.142.68,49.232.152.49,49.232.158.63,49.232.169.74,49.232.29.58,49.232.55.164,49.232.61.104,49.233.132.148,49.233.160.131,49.233.162.31,49.233.180.152,49.233.180.39,49.233.184.148,49.233.193.237,49.233.204.30,49.233.205.35,49.233.213.121,49.233.215.8,49.233.222.150,49.233.223.202,49.233.82.94,49.233.86.26,49.234.106.231,49.234.178.175,49.234.195.122,49.234.224.170,49.234.225.74,49.234.229.15,49.234.230.108,49.234.31.128,49.234.38.22,49.234.60.13,49.234.82.239,49.235.119.78,49.235.142.123,49.235.156.25,49.235.190.171] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 31"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403330; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [49.235.198.185,49.235.217.9,49.235.238.17,49.235.247.78,49.235.26.143,49.235.37.107,49.235.83.89,49.235.98.52,49.236.192.136,49.236.193.70,49.236.195.150,49.248.106.61,49.248.247.94,49.255.130.118,49.255.15.122,49.255.250.130,49.36.140.63,49.4.68.207,49.50.117.48,49.50.118.67,49.50.85.116,49.51.10.24,49.51.10.34,49.51.11.210,49.51.12.179,49.51.12.221,49.51.12.244,49.51.12.60,49.51.12.61,49.51.13.14,49.51.13.40,49.51.134.254,49.51.150.122,49.51.153.23,49.51.153.85,49.51.155.120,49.51.155.205,49.51.160.107,49.51.160.173,49.51.160.201,49.51.160.240,49.51.160.252,49.51.160.31,49.51.160.47,49.51.160.84,49.51.160.91,49.51.161.114,49.51.161.141,49.51.161.145,49.51.161.183] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 32"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403331; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [49.51.161.186,49.51.161.209,49.51.161.236,49.51.161.252,49.51.161.77,49.51.161.95,49.51.162.151,49.51.162.172,49.51.172.33,49.51.199.227,49.51.241.239,49.51.242.147,49.51.242.196,49.51.242.225,49.51.243.251,49.51.252.116,49.51.252.209,49.51.252.40,49.51.253.158,49.51.253.249,49.51.34.136,49.51.34.227,49.51.49.117,49.51.50.208,49.51.51.127,49.51.51.24,49.51.51.53,49.51.52.89,49.51.8.104,49.51.8.188,49.51.8.195,49.51.8.24,49.51.9.105,49.51.9.134,49.51.9.196,49.51.9.204,49.51.9.216,49.67.13.95,49.7.112.94,49.74.79.60,49.77.59.217,49.79.140.162,49.81.70.119,49.82.71.223,49.84.173.240,49.88.112.109,49.88.150.32,50.115.123.52,50.115.147.42,50.115.172.104] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 33"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403332; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [50.116.103.160,50.116.3.115,50.116.57.83,50.116.62.150,50.195.155.21,50.198.68.115,50.202.44.35,50.203.164.134,50.204.227.109,50.206.55.132,50.207.163.12,50.207.164.73,50.208.29.222,50.225.101.226,50.234.173.102,50.234.222.78,50.237.128.182,50.241.16.1,50.243.254.25,50.246.178.154,50.246.217.197,50.248.246.57,50.249.137.45,50.25.169.205,50.252.114.117,50.252.80.115,50.27.159.137,50.31.138.103,50.57.165.121,50.59.222.38,50.66.172.47,50.7.206.2,50.76.148.93,50.76.95.188,50.77.182.77,50.81.238.153,50.84.147.94,50.84.94.18,50.96.178.2,51.132.128.217,51.136.14.170,51.15.85.14,51.158.173.48,51.158.25.170,51.158.29.191,51.158.29.207,51.158.31.194,51.158.31.243,51.159.59.241,51.161.12.231] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 34"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403333; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [51.161.18.75,51.161.9.127,51.161.9.226,51.178.31.86,51.178.49.219,51.178.53.97,51.178.78.152,51.178.78.153,51.178.78.154,51.219.59.129,51.254.49.100,51.254.49.101,51.254.49.102,51.254.49.103,51.254.49.104,51.254.49.105,51.254.49.106,51.254.49.107,51.254.49.108,51.254.49.109,51.254.49.110,51.254.49.111,51.254.49.96,51.254.49.97,51.254.49.98,51.254.49.99,51.255.109.160,51.255.109.162,51.255.109.163,51.255.109.164,51.255.109.165,51.255.109.167,51.255.109.168,51.255.109.169,51.255.109.170,51.255.109.171,51.255.109.172,51.255.109.173,51.255.109.174,51.255.109.175,51.255.165.122,51.255.170.237,51.255.35.82,51.255.67.124,51.38.140.11,51.38.140.6,51.38.16.203,51.38.244.38,51.52.147.58,51.52.159.78] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 35"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403334; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [51.68.143.219,51.68.32.21,51.75.146.114,51.75.161.33,51.75.203.178,51.75.254.172,51.75.52.127,51.77.163.177,51.77.192.7,51.79.145.232,51.79.51.172,51.79.57.12,51.79.70.223,51.79.73.171,51.81.42.232,51.83.171.10,51.83.171.12,51.83.171.14,51.83.171.4,51.83.44.214,51.83.66.171,51.83.78.82,51.89.105.174,51.89.175.65,51.89.235.112,51.89.67.61,51.91.126.182,51.91.136.174,51.91.190.40,51.91.212.79,51.91.212.80,51.91.212.81,51.91.247.125,51.91.253.21,51.91.68.39,52.119.117.10,52.119.117.32,52.130.65.249,52.130.76.97,52.130.81.35,52.130.86.7,52.160.124.197,52.161.91.185,52.165.223.230,52.178.137.197,52.183.2.117,52.183.43.7,52.229.160.94,52.233.19.172,52.243.38.52] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 36"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403335; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [52.55.125.245,52.55.70.221,52.68.122.160,52.71.95.144,52.73.169.169,54.160.158.30,54.161.69.84,54.162.111.223,54.165.231.250,54.178.127.110,54.196.72.32,54.223.61.142,54.255.128.232,54.36.204.128,54.36.204.135,54.36.49.151,54.37.210.42,54.37.234.70,54.38.240.23,54.38.92.35,54.39.104.201,54.39.215.32,58.10.202.129,58.105.192.99,58.119.4.58,58.119.5.210,58.123.19.126,58.126.223.166,58.126.71.17,58.133.232.240,58.137.160.62,58.137.160.66,58.141.232.44,58.144.208.115,58.147.176.235,58.147.180.108,58.147.180.141,58.147.183.105,58.147.183.114,58.147.183.39,58.147.183.68,58.147.183.95,58.152.125.124,58.152.147.221,58.152.149.100,58.152.232.185,58.152.253.76,58.153.154.129,58.153.182.196,58.153.211.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 37"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403336; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [58.16.215.15,58.163.148.232,58.171.253.198,58.176.208.187,58.177.149.10,58.177.208.2,58.18.102.140,58.18.130.101,58.18.133.165,58.18.250.82,58.18.44.214,58.187.9.166,58.19.180.59,58.19.198.18,58.19.248.233,58.194.176.203,58.20.129.49,58.20.41.53,58.210.140.214,58.210.172.118,58.210.89.180,58.21.192.144,58.211.153.58,58.211.162.58,58.211.240.42,58.211.58.121,58.213.134.6,58.213.194.216,58.213.48.218,58.213.48.219,58.213.91.17,58.213.91.4,58.213.91.9,58.214.255.41,58.215.186.240,58.215.221.82,58.215.235.146,58.215.44.35,58.215.44.43,58.215.44.54,58.215.49.242,58.215.57.137,58.215.61.68,58.215.75.134,58.215.9.154,58.216.101.113,58.216.149.158,58.216.160.214,58.216.164.67,58.216.172.22] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 38"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403337; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [58.216.176.183,58.216.47.50,58.216.51.206,58.216.8.83,58.217.103.57,58.217.157.209,58.217.157.233,58.217.157.46,58.218.185.141,58.218.185.20,58.218.204.20,58.218.213.141,58.218.251.214,58.218.66.85,58.218.67.142,58.219.103.72,58.220.25.2,58.220.33.54,58.220.46.28,58.220.46.37,58.220.46.62,58.220.56.3,58.22.101.120,58.22.218.108,58.221.134.146,58.221.135.150,58.221.173.38,58.221.190.98,58.221.222.194,58.221.247.206,58.221.62.214,58.222.197.186,58.222.233.124,58.222.24.171,58.228.159.253,58.23.211.14,58.236.67.164,58.241.135.9,58.242.68.178,58.246.209.134,58.247.120.118,58.250.27.18,58.252.108.38,58.252.108.40,58.252.108.41,58.254.35.178,58.255.77.17,58.30.80.209,58.32.211.77,58.42.233.74] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 39"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403338; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [58.49.160.175,58.49.230.254,58.49.59.12,58.49.59.43,58.49.94.62,58.51.216.86,58.51.57.85,58.54.82.179,58.56.166.66,58.56.191.30,58.56.200.58,58.56.33.221,58.56.56.174,58.56.66.199,58.57.53.134,58.59.176.111,58.59.176.4,58.59.25.2,58.61.38.185,58.63.245.235,58.64.155.101,58.64.157.162,58.64.160.36,58.64.180.40,58.64.200.114,58.64.200.176,58.64.209.254,58.64.40.72,58.65.153.246,58.65.169.6,58.67.137.189,58.67.221.163,58.7.210.232,58.71.252.152,58.76.162.249,58.82.192.215,58.82.233.119,58.87.68.202,58.87.70.99,58.93.26.10,58.96.222.97,58.97.14.227,58.99.0.202,59.0.22.131,59.0.75.71,59.0.85.168,59.1.101.81,59.108.32.55,59.108.47.88,59.110.217.182] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 40"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403339; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.110.240.245,59.11.107.39,59.11.248.116,59.11.26.52,59.11.82.111,59.115.127.211,59.115.141.158,59.120.103.137,59.120.55.33,59.120.74.96,59.124.115.208,59.124.11.71,59.124.229.26,59.124.254.14,59.125.139.32,59.125.188.151,59.125.189.53,59.125.218.155,59.125.218.249,59.125.226.69,59.125.4.119,59.125.55.151,59.125.89.91,59.126.102.222,59.126.111.191,59.126.111.253,59.126.124.101,59.126.14.131,59.126.147.69,59.126.15.19,59.126.159.144,59.126.160.208,59.126.166.60,59.126.169.60,59.126.171.21,59.126.20.169,59.126.208.127,59.126.214.100,59.126.227.185,59.126.230.135,59.126.242.29,59.126.3.195,59.126.32.32,59.126.34.89,59.126.36.14,59.126.4.20,59.126.55.105,59.126.69.205,59.126.7.178,59.126.81.179] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 41"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403340; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.126.87.123,59.126.92.112,59.127.101.240,59.127.10.133,59.127.113.141,59.127.131.183,59.127.13.161,59.127.147.110,59.127.166.81,59.127.181.133,59.127.191.68,59.127.197.36,59.127.202.201,59.127.203.50,59.127.236.228,59.127.240.138,59.127.251.94,59.127.252.150,59.127.27.186,59.127.4.171,59.127.41.84,59.127.42.161,59.127.49.26,59.127.51.67,59.127.53.167,59.127.63.180,59.127.64.75,59.127.69.111,59.127.73.150,59.127.9.232,59.127.97.41,59.145.211.194,59.148.21.4,59.148.2.18,59.149.150.143,59.15.16.138,59.152.161.194,59.152.251.30,59.16.203.219,59.163.248.100,59.165.162.70,59.17.123.104,59.173.12.166,59.173.238.118,59.173.46.163,59.174.79.73,59.175.228.60,59.179.31.46,59.181.142.186,59.186.44.134] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 42"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403341; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.188.196.226,59.188.30.20,59.188.72.137,59.188.73.200,59.190.91.121,59.19.195.226,59.22.165.54,59.22.96.35,59.23.93.237,59.24.104.209,59.24.115.124,59.24.189.107,59.26.190.23,59.26.212.234,59.26.237.138,59.27.118.163,59.27.12.43,59.27.16.224,59.30.208.105,59.30.39.51,59.36.143.3,59.37.8.105,59.38.100.118,59.38.35.102,59.4.199.175,59.41.184.206,59.42.89.253,59.44.149.52,59.44.149.53,59.44.37.156,59.46.0.36,59.46.43.58,59.46.53.210,59.47.122.105,59.49.104.232,59.50.85.195,59.5.196.9,59.55.128.170,59.55.5.133,59.56.226.180,59.56.65.125,59.56.65.13,59.57.183.237,59.57.248.34,59.58.206.226,59.60.84.37,59.6.147.79,59.61.204.158,59.63.163.165,59.63.163.49] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 43"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403342; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.63.169.10,59.7.155.141,59.7.22.130,59.76.80.213,59.8.137.44,59.9.119.87,60.12.104.157,60.12.155.220,60.12.33.9,60.12.94.186,60.13.146.20,60.13.194.158,60.13.194.71,60.13.218.82,60.13.240.104,60.15.251.149,60.15.251.150,60.15.251.151,60.15.251.152,60.15.251.153,60.15.251.154,60.15.251.155,60.15.34.250,60.164.172.206,60.164.190.154,60.165.242.196,60.165.53.185,60.167.71.10,60.169.66.243,60.170.101.25,60.170.10.219,60.170.119.252,60.170.166.189,60.170.166.72,60.170.180.96,60.170.189.102,60.170.203.82,60.170.218.225,60.170.255.227,60.17.248.233,60.172.5.109,60.172.8.10,60.173.178.149,60.173.179.69,60.173.252.157,60.173.255.176,60.174.186.11,60.174.21.13,60.174.21.251,60.174.2.55] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 44"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403343; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [60.174.55.78,60.175.124.27,60.175.124.8,60.18.128.4,60.18.184.72,60.184.176.155,60.186.119.2,60.188.102.160,60.188.173.8,60.189.40.177,60.190.143.82,60.190.239.58,60.190.249.119,60.190.249.121,60.190.96.235,60.191.0.118,60.191.119.99,60.191.127.122,60.191.52.254,60.199.223.17,60.2.240.94,60.2.245.166,60.2.26.206,60.205.200.235,60.208.127.75,60.208.128.251,60.209.36.26,60.210.103.211,60.210.211.42,60.210.7.222,60.213.17.106,60.214.153.118,60.215.165.97,60.216.75.24,60.216.86.130,60.216.99.222,60.217.68.88,60.218.191.175,60.218.191.177,60.218.191.182,60.218.191.224,60.220.54.14,60.22.74.221,60.221.229.142,60.221.244.100,60.223.239.164,60.224.2.170,60.246.136.137,60.246.184.131,60.246.192.13] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 45"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403344; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [60.246.234.0,60.246.75.194,60.248.122.172,60.248.122.97,60.248.127.85,60.248.130.106,60.248.136.209,60.248.139.169,60.248.157.116,60.248.49.70,60.249.117.226,60.249.145.25,60.249.253.179,60.249.80.221,60.249.84.190,60.249.90.226,60.250.235.148,60.251.111.30,60.251.137.215,60.251.140.1,60.251.151.168,60.251.165.18,60.251.199.192,60.251.203.79,60.251.55.15,60.251.80.76,60.251.80.85,60.255.139.145,60.255.41.150,60.28.201.185,60.28.24.184,60.30.147.118,60.31.180.229,60.31.193.20,60.48.210.204,60.6.210.131,60.7.148.126,60.7.75.85,60.8.180.8,60.8.197.210,60.8.216.98,60.9.234.17,61.10.28.30,61.102.164.30,61.102.169.89,61.109.243.91,61.125.156.67,61.129.180.178,61.130.110.198,61.131.20.133] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 46"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403345; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.131.207.66,61.131.228.76,61.132.42.50,61.132.87.130,61.133.118.6,61.133.194.58,61.133.238.130,61.134.23.202,61.135.215.237,61.136.101.103,61.136.101.76,61.136.143.165,61.136.144.163,61.138.54.99,61.139.104.194,61.139.105.98,61.142.119.19,61.142.29.2,61.142.75.66,61.143.205.222,61.143.205.229,61.143.43.3,61.143.44.54,61.143.53.234,61.144.244.75,61.146.115.89,61.146.199.186,61.147.103.136,61.147.103.181,61.147.111.169,61.147.115.149,61.147.96.169,61.148.205.166,61.148.222.198,61.148.238.4,61.149.142.110,61.150.76.201,61.151.247.189,61.152.90.81,61.153.110.83,61.157.138.117,61.157.86.148,61.157.91.111,61.158.167.184,61.160.196.28,61.160.200.58,61.160.245.66,61.160.251.29,61.161.155.100,61.161.198.99] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 47"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403346; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.163.165.101,61.163.192.28,61.163.200.249,61.163.216.136,61.163.89.27,61.164.115.242,61.164.37.178,61.164.57.108,61.164.96.126,61.164.96.82,61.164.96.98,61.164.98.226,61.165.35.62,61.167.22.144,61.170.132.67,61.174.49.17,61.174.50.171,61.174.50.50,61.177.142.200,61.177.72.251,61.178.103.131,61.178.103.133,61.178.103.137,61.178.103.146,61.178.103.148,61.178.108.175,61.178.19.67,61.178.249.22,61.178.249.25,61.178.29.191,61.178.29.50,61.178.32.88,61.178.63.247,61.178.66.14,61.178.81.109,61.181.255.77,61.183.52.106,61.183.52.133,61.183.52.144,61.183.52.146,61.183.52.45,61.183.52.5,61.183.9.45,61.184.234.23,61.188.103.193,61.189.42.58,61.190.124.188,61.190.124.208,61.190.18.46,61.190.97.94] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 48"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403347; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.19.108.118,61.19.30.156,61.19.64.9,61.191.101.186,61.191.98.59,61.216.104.177,61.216.109.80,61.216.145.231,61.216.164.89,61.216.183.94,61.216.2.79,61.216.35.96,61.216.40.209,61.216.51.177,61.216.91.27,61.216.92.89,61.218.122.209,61.218.134.110,61.218.212.14,61.218.250.137,61.218.44.95,61.219.11.153,61.219.170.130,61.219.178.89,61.219.81.58,61.219.98.71,61.220.101.99,61.220.128.67,61.220.150.137,61.220.182.91,61.220.196.1,61.220.204.216,61.220.216.179,61.220.251.176,61.221.167.145,61.221.180.244,61.222.127.115,61.222.241.229,61.223.165.19,61.223.28.212,61.231.243.19,61.233.14.171,61.243.130.64,61.243.39.70,61.244.125.236,61.244.174.58,61.244.206.38,61.244.247.105,61.247.67.122,61.252.53.180] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 49"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403348; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.255.61.136,61.48.20.118,61.50.101.202,61.50.110.114,61.50.117.74,61.50.133.43,61.50.195.4,61.53.230.134,61.53.64.245,61.53.69.32,61.54.2.103,61.54.231.129,61.55.29.223,61.6.200.26,61.61.88.135,61.65.132.213,61.68.17.70,61.68.191.80,61.68.221.158,61.68.25.46,61.7.235.85,61.7.253.197,61.72.242.227,61.74.53.173,61.74.53.221,61.76.221.147,61.76.59.114,61.77.134.65,61.77.34.77,61.77.79.160,61.78.96.158,61.8.69.98,61.82.40.103,61.83.86.105,61.83.97.180,61.84.138.57,61.84.247.221,61.85.12.175,61.85.155.134,61.90.140.210,61.90.160.216,61.91.53.2,61.99.132.215,62.0.134.162,62.103.31.228,62.108.37.26,62.113.117.93,62.114.126.172,62.141.113.30,62.141.129.158] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 50"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403349; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [62.148.150.183,62.150.126.58,62.150.192.1,62.169.239.187,62.171.132.67,62.171.152.36,62.171.167.199,62.171.176.180,62.171.177.76,62.172.234.115,62.172.234.21,62.173.140.21,62.174.134.219,62.176.123.148,62.192.41.82,62.210.105.231,62.210.116.151,62.210.143.6,62.210.70.74,62.210.76.202,62.212.104.138,62.212.230.38,62.213.82.18,62.215.6.11,62.219.193.224,62.219.226.245,62.220.210.145,62.224.217.49,62.232.133.26,62.234.110.221,62.234.126.21,62.234.127.150,62.234.139.150,62.234.140.15,62.234.6.145,62.234.62.219,62.234.89.176,62.234.98.144,62.235.28.18,62.240.112.70,62.244.140.37,62.255.13.246,62.28.0.172,62.28.122.194,62.28.163.82,62.28.181.122,62.28.187.44,62.28.192.210,62.28.192.86,62.28.203.66] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 51"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403350; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [62.28.211.26,62.28.215.142,62.28.215.30,62.28.227.30,62.28.23.83,62.28.246.118,62.28.24.98,62.28.28.242,62.28.29.150,62.28.30.206,62.28.58.118,62.28.88.118,62.28.9.238,62.33.199.134,62.4.14.123,62.4.48.234,62.45.209.242,62.48.218.138,62.68.144.60,62.69.130.155,62.77.173.242,62.90.162.254,62.90.192.239,62.94.211.10,62.97.173.73,62.98.245.87,62.98.71.215,62.99.119.151,62.99.55.78,63.134.149.24,63.143.88.210,63.168.21.195,63.225.161.101,63.237.48.34,63.78.116.109,64.121.52.239,64.182.119.2,64.184.197.239,64.19.86.182,64.225.103.7,64.225.104.142,64.225.106.89,64.225.107.165,64.225.111.247,64.225.112.28,64.225.115.188,64.225.116.46,64.225.118.25,64.225.118.99,64.225.123.93] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 52"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403351; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [64.225.127.44,64.225.14.108,64.225.2.140,64.225.22.43,64.225.25.10,64.225.3.129,64.225.3.172,64.225.42.104,64.225.45.177,64.225.70.13,64.225.78.156,64.225.78.39,64.225.8.170,64.225.98.118,64.227.10.240,64.227.116.238,64.227.120.56,64.227.120.58,64.227.120.63,64.227.12.177,64.227.12.99,64.227.17.251,64.227.21.199,64.227.21.239,64.227.22.194,64.227.23.146,64.227.23.233,64.227.24.112,64.227.24.206,64.227.25.158,64.227.25.174,64.227.25.180,64.227.29.237,64.227.35.138,64.227.35.162,64.227.36.221,64.227.4.164,64.227.45.97,64.227.54.28,64.227.56.27,64.227.6.231,64.227.70.78,64.227.71.59,64.227.72.66,64.227.73.193,64.227.74.144,64.227.9.196,64.32.21.254,64.34.49.230,64.37.51.69] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 53"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403352; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [64.53.101.72,64.64.104.10,64.79.89.138,64.91.124.170,64.91.249.207,64.91.64.222,64.91.76.97,65.110.110.218,65.126.27.58,65.132.139.90,65.19.154.162,65.19.174.198,65.19.174.248,65.223.59.43,65.23.157.74,65.24.235.86,65.39.201.178,65.49.20.100,65.49.20.102,65.49.20.103,65.49.20.104,65.49.20.105,65.49.20.106,65.49.20.107,65.49.20.108,65.49.20.109,65.49.20.112,65.49.20.113,65.49.20.117,65.49.20.118,65.49.20.119,65.49.20.121,65.49.20.122,65.49.20.123,65.49.20.124,65.49.20.125,65.49.20.126,65.49.20.72,65.49.20.76,65.49.20.77,65.49.20.78,65.49.20.80,65.49.20.83,65.49.20.84,65.49.20.85,65.49.20.87,65.49.20.88,65.49.20.91,65.49.20.94,65.49.20.97] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 54"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403353; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [65.49.20.99,65.50.147.71,65.73.156.118,65.75.101.49,65.91.52.175,65.99.166.103,66.108.21.155,66.108.223.228,66.114.118.39,66.117.12.196,66.130.177.164,66.146.180.130,66.153.195.73,66.168.122.180,66.175.156.188,66.181.166.128,66.189.219.80,66.196.62.167,66.205.179.226,66.220.12.90,66.232.63.37,66.235.84.52,66.240.192.138,66.240.205.34,66.240.219.146,66.240.236.119,66.31.253.240,66.34.192.9,66.42.166.10,66.42.48.10,66.42.55.119,66.42.60.60,66.64.44.226,66.70.250.106,66.76.46.118,66.83.166.14,66.97.181.216,67.140.143.123,67.149.11.83,67.159.148.230,67.166.23.54,67.168.252.22,67.183.251.230,67.198.189.221,67.198.189.223,67.198.189.224,67.198.189.225,67.198.189.228,67.198.189.244,67.198.189.52] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 55"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403354; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [67.198.189.53,67.198.189.56,67.198.189.57,67.198.189.69,67.198.232.59,67.200.151.42,67.200.223.178,67.200.232.243,67.205.144.244,67.205.154.203,67.205.160.31,67.205.166.143,67.205.166.88,67.205.170.239,67.205.173.227,67.206.200.122,67.207.88.180,67.213.235.14,67.214.201.51,67.215.244.230,67.225.163.49,67.227.152.142,67.229.135.18,67.229.175.226,67.231.21.21,67.243.144.153,67.244.21.162,67.253.103.144,67.53.2.150,67.54.156.88,67.55.9.0,67.58.24.46,67.78.173.90,67.78.4.26,67.78.68.198,67.79.23.170,67.80.150.104,67.84.196.148,67.9.122.230,68.107.172.103,68.110.199.79,68.11.156.29,68.132.136.198,68.132.184.223,68.144.91.97,68.150.109.112,68.161.231.230,68.171.157.231,68.173.243.86,68.183.107.155] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 56"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403355; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [68.183.12.127,68.183.146.178,68.183.153.161,68.183.157.244,68.183.157.29,68.183.16.217,68.183.180.179,68.183.182.120,68.183.183.118,68.183.183.27,68.183.186.25,68.183.187.13,68.183.187.234,68.183.193.132,68.183.215.157,68.183.229.218,68.183.28.186,68.183.31.75,68.183.34.236,68.183.37.169,68.183.55.223,68.183.56.212,68.183.78.87,68.183.80.250,68.183.85.116,68.183.86.198,68.183.92.100,68.183.92.118,68.183.92.251,68.183.95.11,68.183.95.39,68.194.144.147,68.198.214.252,68.255.154.241,68.35.159.199,68.44.108.200,68.51.19.20,68.67.210.83,68.70.49.253,68.96.25.174,69.118.29.81,69.133.145.244,69.142.158.70,69.146.134.2,69.162.74.166,69.164.210.109,69.165.173.49,69.165.224.111,69.165.230.239,69.171.192.58] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 57"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403356; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [69.175.97.170,69.175.97.171,69.175.97.172,69.175.97.173,69.175.97.174,69.193.158.70,69.193.2.251,69.193.59.111,69.197.191.186,69.248.57.179,69.28.34.18,69.39.57.78,69.41.128.33,69.42.66.94,69.42.81.68,69.42.89.216,69.47.208.113,69.60.23.149,69.65.79.99,69.70.96.242,69.75.64.34,69.76.196.64,69.80.31.143,69.84.97.248,69.90.184.206,69.90.184.209,69.94.155.176,70.113.157.223,70.118.38.142,70.124.223.136,70.169.134.185,70.182.172.19,70.25.69.174,70.33.206.130,70.37.61.136,70.44.225.34,70.52.189.82,70.60.38.12,70.74.196.3,70.78.110.101,70.81.4.114,70.89.57.206,71.104.27.123,71.12.27.38,71.127.40.137,71.14.255.251,71.14.87.212,71.167.41.46,71.183.79.85,71.189.93.102] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 58"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403357; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [71.221.32.243,71.225.166.165,71.233.207.169,71.237.97.77,71.251.119.91,71.251.92.8,71.254.8.90,71.29.91.228,71.41.76.58,71.41.76.62,71.42.172.44,71.42.228.182,71.47.104.200,71.56.46.143,71.6.135.131,71.6.146.130,71.6.146.185,71.6.146.186,71.6.147.254,71.6.158.166,71.6.165.200,71.6.167.142,71.6.199.23,71.6.231.186,71.6.231.8,71.6.231.80,71.6.231.81,71.6.231.83,71.6.231.86,71.6.231.87,71.6.232.4,71.6.232.5,71.6.232.6,71.6.232.8,71.66.4.243,71.74.248.144,71.78.133.84,71.78.192.34,71.84.72.147,71.90.14.60,71.95.6.42,72.130.215.174,72.138.45.190,72.138.83.242,72.17.22.30,72.17.50.206,72.17.60.150,72.181.243.237,72.182.166.90,72.186.211.177] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 59"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403358; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [72.187.208.210,72.187.238.18,72.188.165.48,72.200.244.203,72.20.91.172,72.213.21.79,72.216.202.55,72.224.252.150,72.249.226.29,72.249.56.8,72.252.114.154,72.252.196.30,72.252.247.85,72.253.108.147,72.255.111.147,72.27.95.89,72.34.42.196,72.38.192.163,72.4.34.117,72.43.195.114,72.43.19.94,72.53.106.100,72.53.233.6,72.55.235.235,72.55.235.249,72.76.147.193,72.80.19.63,72.80.30.200,72.89.131.110,72.89.153.61,72.95.129.172,73.107.103.239,73.117.30.152,73.124.60.38,73.125.172.169,73.129.186.234,73.139.52.253,73.144.145.41,73.175.132.254,73.177.101.8,73.18.136.31,73.185.241.75,73.194.116.117,73.204.200.55,73.223.12.30,73.232.33.168,73.245.127.219,73.251.244.10,73.29.72.229,73.32.102.153] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 60"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403359; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [73.51.74.139,73.70.242.70,73.77.91.35,73.85.110.241,73.91.22.9,73.92.227.135,74.101.171.253,74.102.39.43,74.114.72.98,74.120.200.170,74.130.35.52,74.15.117.194,74.15.22.215,74.194.221.83,74.204.141.196,74.207.227.48,74.213.112.113,74.215.200.125,74.221.64.4,74.50.155.232,74.62.91.28,74.63.228.198,74.64.36.123,74.77.210.174,74.85.156.34,74.96.219.2,75.1.97.126,75.109.218.53,75.111.166.126,75.113.131.233,75.113.223.38,75.145.126.193,75.148.156.244,75.150.9.174,75.155.220.20,75.160.214.216,75.172.8.126,75.74.38.207,76.109.197.156,76.164.153.25,76.170.55.195,76.171.104.248,76.173.238.69,76.174.197.9,76.179.248.164,76.187.66.245,76.190.103.182,76.190.16.98,76.240.125.9,76.66.166.35] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 61"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403360; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [76.76.189.82,77.106.106.191,77.107.41.121,77.107.41.186,77.107.41.216,77.108.52.128,77.121.174.100,77.122.249.132,77.123.134.244,77.138.251.193,77.139.197.124,77.220.133.164,77.222.134.242,77.228.70.225,77.232.100.210,77.232.170.186,77.237.87.208,77.239.225.166,77.239.59.192,77.239.65.206,77.240.151.154,77.240.89.92,77.242.20.190,77.243.181.54,77.246.101.4,77.247.108.119,77.247.108.77,77.247.109.101,77.247.109.241,77.247.109.5,77.247.109.68,77.247.109.72,77.247.109.73,77.247.110.25,77.247.110.58,77.254.209.158,77.26.155.10,77.31.30.66,77.36.18.226,77.38.243.75,77.41.123.213,77.45.13.85,77.46.133.145,77.46.179.227,77.47.192.82,77.48.24.62,77.51.177.114,77.53.125.3,77.54.105.77,77.58.98.121] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 62"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403361; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [77.70.80.234,77.71.232.31,77.75.129.136,77.79.132.10,77.79.134.90,77.81.191.142,77.81.54.130,77.81.67.194,77.85.165.204,77.89.239.218,77.95.0.50,77.95.161.35,78.105.68.110,78.108.177.50,78.108.177.51,78.108.177.52,78.108.177.53,78.108.177.54,78.109.129.108,78.120.56.104,78.128.113.42,78.128.41.7,78.131.11.97,78.132.141.106,78.134.12.21,78.139.235.56,78.139.2.89,78.142.228.9,78.152.161.133,78.165.78.210,78.172.61.45,78.175.71.19,78.185.198.164,78.186.156.212,78.186.200.80,78.186.214.135,78.186.219.202,78.187.11.158,78.187.203.177,78.187.235.44,78.187.26.201,78.187.56.7,78.187.5.99,78.188.141.214,78.188.151.201,78.188.168.199,78.188.172.184,78.188.193.106,78.188.197.69,78.188.21.128] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 63"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403362; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [78.188.218.80,78.188.228.144,78.188.238.108,78.188.37.3,78.188.42.22,78.188.59.87,78.188.74.50,78.188.86.210,78.188.86.98,78.189.154.68,78.192.61.77,78.194.1.42,78.21.253.107,78.217.160.38,78.22.61.76,78.24.218.27,78.25.143.8,78.29.32.105,78.29.9.120,78.30.46.42,78.33.49.186,78.37.87.19,78.38.98.152,78.41.93.6,78.5.170.222,78.56.118.81,78.56.74.42,78.58.115.148,78.61.219.49,78.66.209.22,78.67.120.206,78.67.120.64,78.68.121.208,78.70.54.137,78.70.61.235,78.71.234.246,78.72.233.107,78.72.255.180,78.72.255.234,78.84.219.13,78.84.25.2,78.85.36.59,78.85.69.118,78.87.105.254,78.90.130.13,78.90.200.215,78.96.0.85,78.96.17.76,78.96.32.107,79.0.173.121] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 64"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403363; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [79.0.181.62,79.0.214.80,79.10.108.242,79.10.194.249,79.10.209.109,79.10.211.202,79.10.35.178,79.1.180.90,79.1.194.79,79.107.164.159,79.109.224.221,79.11.212.202,79.11.57.169,79.111.242.3,79.113.214.168,79.115.117.101,79.116.147.251,79.116.243.165,79.117.71.68,79.118.148.62,79.118.78.244,79.12.182.192,79.121.107.210,79.121.109.66,79.121.92.108,79.124.62.51,79.124.62.55,79.124.62.66,79.124.62.82,79.124.62.86,79.124.8.95,79.129.138.102,79.129.14.107,79.129.52.162,79.130.63.54,79.131.80.183,79.133.151.229,79.133.201.82,79.134.206.30,79.135.40.228,79.135.72.36,79.135.73.132,79.136.83.52,79.138.8.251,79.138.9.68,79.140.20.207,79.143.32.195,79.152.165.196,79.173.183.30,79.173.253.197] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 65"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403364; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [79.175.152.160,79.175.176.229,79.175.36.37,79.187.16.142,79.189.124.138,79.19.122.166,79.23.205.219,79.237.151.235,79.25.209.75,79.26.149.125,79.36.209.206,79.40.223.104,79.44.247.190,79.46.64.104,79.52.104.158,79.53.33.160,79.53.89.49,79.56.167.101,79.56.57.125,79.58.204.202,79.58.215.225,79.59.152.40,79.6.204.141,79.6.210.116,79.70.161.55,79.7.146.245,79.7.179.104,79.72.70.205,79.78.46.116,79.79.39.112,79.79.44.100,79.8.100.126,79.8.243.10,79.8.66.59,80.104.17.57,80.106.182.194,80.11.35.146,80.111.60.4,80.112.133.223,80.116.106.158,80.120.151.142,80.150.175.147,80.15.208.223,80.15.21.65,80.151.81.13,80.156.215.4,80.178.121.35,80.178.214.52,80.180.128.48,80.180.173.238] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 66"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403365; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [80.180.179.121,80.181.213.59,80.183.124.229,80.184.84.135,80.184.84.163,80.194.234.223,80.20.231.251,80.211.128.151,80.211.131.110,80.211.136.164,80.211.139.133,80.211.156.86,80.211.171.78,80.211.230.27,80.211.241.152,80.211.24.117,80.211.244.16,80.211.34.241,80.211.35.87,80.211.37.15,80.211.67.90,80.211.79.220,80.211.84.100,80.211.89.9,80.212.149.174,80.216.239.79,80.217.240.176,80.22.249.253,80.227.193.178,80.229.150.236,80.229.37.136,80.232.171.241,80.232.185.174,80.242.65.194,80.246.2.152,80.248.10.237,80.248.10.251,80.252.143.210,80.253.20.94,80.254.120.31,80.28.229.86,80.38.139.178,80.55.175.172,80.65.29.139,80.67.223.41,80.70.190.113,80.72.82.82,80.73.91.130,80.76.42.125,80.77.112.148] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 67"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403366; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [80.78.69.194,80.82.46.191,80.82.64.110,80.82.64.127,80.82.64.219,80.82.64.73,80.82.65.62,80.82.65.74,80.82.70.118,80.82.70.239,80.82.77.132,80.82.77.139,80.82.77.189,80.82.77.212,80.82.77.227,80.82.77.232,80.82.77.234,80.82.77.235,80.82.77.245,80.82.77.33,80.82.77.85,80.82.77.86,80.82.78.100,80.82.78.104,80.82.78.192,80.82.78.20,80.82.78.211,80.87.77.100,80.92.100.202,80.93.210.202,80.98.200.246,81.105.223.91,81.107.255.176,81.107.85.15,81.12.94.122,81.12.94.126,81.128.164.27,81.128.191.59,81.134.252.250,81.144.129.98,81.145.192.123,81.145.52.54,81.148.211.2,81.156.104.0,81.159.244.34,81.16.117.56,81.168.131.214,81.17.92.4,81.177.181.222,81.18.59.251] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 68"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403367; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [81.182.242.133,81.182.246.50,81.190.16.18,81.192.52.89,81.192.53.131,81.196.75.11,81.196.95.201,81.205.223.85,81.209.62.121,81.209.69.175,81.213.150.156,81.213.154.253,81.213.199.64,81.213.59.71,81.214.129.221,81.214.143.47,81.218.199.121,81.218.213.101,81.22.48.96,81.224.30.133,81.224.30.169,81.225.115.46,81.227.222.184,81.228.128.247,81.230.173.135,81.232.187.223,81.233.111.151,81.233.23.246,81.234.178.123,81.236.252.32,81.241.207.133,81.241.238.49,81.247.212.104,81.248.4.6,81.250.151.128,81.25.58.50,81.255.98.151,81.28.41.5,81.30.182.145,81.31.238.43,81.40.101.10,81.4.112.221,81.4.245.44,81.47.170.93,81.5.142.220,81.7.137.124,81.82.247.71,81.83.235.170,81.88.116.237,81.88.221.227] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 69"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403368; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [81.93.101.46,81.94.18.207,81.94.243.61,82.1.164.58,82.102.12.136,82.102.158.84,82.102.173.75,82.103.95.42,82.103.95.46,82.114.67.122,82.117.235.56,82.118.231.39,82.119.93.12,82.127.237.205,82.135.63.190,82.137.26.250,82.142.104.141,82.154.208.42,82.154.209.76,82.154.212.19,82.155.111.104,82.163.234.174,82.165.195.173,82.166.147.24,82.166.239.179,82.194.17.249,82.194.18.11,82.196.105.39,82.198.187.191,82.200.142.22,82.200.251.66,82.200.97.206,82.202.197.233,82.202.70.7,82.208.151.125,82.209.198.252,82.209.249.65,82.212.103.10,82.213.250.184,82.214.152.19,82.221.105.6,82.221.105.7,82.223.115.97,82.235.152.201,82.251.101.135,82.253.98.115,82.255.154.111,82.255.38.238,82.40.248.82,82.45.17.179] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 70"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403369; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [82.50.145.178,82.54.129.74,82.57.125.243,82.62.118.102,82.62.16.201,82.62.206.199,82.62.246.70,82.62.39.72,82.62.45.48,82.64.216.10,82.66.193.96,82.76.110.144,82.76.134.53,82.76.16.50,82.76.44.175,82.77.172.31,82.77.63.9,82.78.246.241,82.78.33.11,82.78.88.114,82.79.150.228,82.79.220.25,82.79.227.215,82.80.54.90,82.81.134.138,82.96.32.125,82.96.41.180,82.97.201.55,82.99.193.52,83.0.189.110,83.0.235.46,83.101.139.170,83.102.172.104,83.103.237.117,83.110.104.31,83.110.147.165,83.110.239.253,83.110.5.148,83.110.55.167,83.110.87.206,83.111.205.146,83.12.148.202,83.12.179.10,83.128.59.45,83.136.114.154,83.136.238.93,83.14.224.41,83.143.148.197,83.143.246.30,83.153.149.104] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 71"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403370; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [83.166.215.168,83.167.1.169,83.169.197.13,83.169.220.167,83.17.199.157,83.19.149.186,83.198.158.135,83.208.46.43,83.209.249.33,83.209.40.236,83.209.4.72,83.209.60.116,83.220.172.181,83.221.222.154,83.222.171.108,83.222.189.170,83.226.4.152,83.227.94.231,83.228.104.207,83.228.23.146,83.228.34.217,83.233.162.185,83.233.167.87,83.233.68.162,83.235.176.144,83.239.149.47,83.239.167.62,83.239.186.54,83.239.46.124,83.240.141.118,83.240.181.170,83.240.182.154,83.240.182.242,83.240.182.94,83.240.187.170,83.240.189.18,83.240.191.254,83.240.209.242,83.240.213.214,83.240.236.118,83.240.241.46,83.240.242.246,83.240.242.250,83.240.243.66,83.246.233.22,83.250.212.218,83.250.212.227,83.253.119.99,83.253.40.16,83.254.101.183] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 72"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403371; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [83.254.102.243,83.3.151.42,83.3.255.6,83.35.232.241,83.36.185.75,83.39.126.104,83.53.97.181,83.66.123.87,83.66.172.90,83.68.225.108,83.68.232.158,83.68.237.104,83.69.222.102,83.86.11.248,83.96.12.44,83.97.20.133,83.97.20.140,83.97.20.164,83.97.20.186,83.97.20.203,83.97.20.206,83.97.20.224,83.97.20.226,83.97.20.232,83.97.20.25,83.97.20.31,83.97.20.34,83.98.249.26,84.108.40.17,84.213.176.207,84.215.250.24,84.217.92.220,84.219.195.128,84.219.210.249,84.22.144.52,84.22.35.210,84.228.100.125,84.228.102.198,84.232.227.181,84.234.255.222,84.236.168.158,84.237.104.15,84.237.164.20,84.238.101.103,84.241.56.76,84.242.118.84,84.242.132.114,84.243.217.202,84.243.226.186,84.244.47.42] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 73"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403372; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [84.255.202.188,84.33.124.223,84.38.184.53,84.40.122.204,84.43.107.189,84.46.146.161,84.47.161.29,84.51.14.186,84.51.60.137,84.53.237.140,84.54.185.34,84.9.21.185,84.99.36.50,85.101.72.20,85.104.121.76,85.105.102.69,85.105.109.2,85.105.153.136,85.105.154.118,85.105.155.95,85.105.165.165,85.105.170.120,85.105.217.130,85.105.218.93,85.105.231.221,85.105.247.98,85.105.36.139,85.105.39.105,85.105.44.231,85.105.69.143,85.108.221.118,85.11.48.222,85.116.124.122,85.117.32.86,85.12.231.73,85.12.242.154,85.122.92.177,85.13.101.172,85.132.106.148,85.132.79.170,85.133.190.156,85.14.10.115,85.143.106.73,85.149.18.254,85.149.51.154,85.159.27.40,85.159.66.131,85.16.100.54,85.16.133.247,85.172.11.101] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 74"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403373; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [85.172.79.25,85.175.100.254,85.185.200.161,85.187.124.112,85.187.209.227,85.187.218.116,85.187.220.39,85.187.82.44,85.191.109.196,85.192.59.10,85.196.181.250,85.198.184.205,85.202.176.146,85.207.44.11,85.208.213.24,85.208.220.25,85.209.0.100,85.209.0.134,85.209.0.57,85.209.0.69,85.214.104.50,85.217.204.38,85.224.196.195,85.224.199.40,85.225.27.72,85.226.179.186,85.227.85.44,85.229.171.73,85.230.173.199,85.230.175.14,85.234.6.140,85.246.37.124,85.249.97.230,85.255.203.42,85.26.227.154,85.28.108.39,85.30.232.135,85.31.113.143,85.31.33.6,85.62.12.250,85.66.47.175,85.70.179.251,85.72.38.209,85.88.162.44,85.89.183.27,85.90.208.125,85.93.20.248,85.95.153.59,85.97.184.130,85.97.187.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 75"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403374; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [85.99.175.144,85.99.247.245,85.99.97.62,85.99.98.182,86.1.206.76,86.102.131.30,86.102.175.6,86.105.120.221,86.105.53.132,86.108.23.2,86.120.27.226,86.120.40.195,86.121.227.160,86.121.33.1,86.122.123.48,86.122.144.77,86.122.55.214,86.122.58.49,86.122.68.179,86.123.179.13,86.123.182.87,86.123.211.133,86.124.143.85,86.124.63.66,86.124.74.104,86.124.92.241,86.125.37.119,86.125.38.101,86.126.153.135,86.126.153.141,86.127.101.48,86.127.253.84,86.127.79.80,86.138.217.137,86.140.78.120,86.170.111.175,86.193.152.3,86.233.85.32,86.238.210.123,86.34.38.177,86.34.72.210,86.35.202.193,86.35.214.87,86.35.35.99,86.38.171.149,86.45.145.20,86.57.131.182,86.57.170.160,86.57.173.146,86.57.235.240] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 76"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403375; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [86.57.247.26,86.57.93.97,86.60.114.16,86.61.77.254,86.62.5.233,86.8.113.179,86.90.55.201,86.91.191.103,86.92.131.190,86.93.142.223,86.98.158.141,86.98.36.46,86.98.59.115,86.98.82.8,87.103.170.105,87.107.124.36,87.110.185.78,87.110.236.155,87.118.56.50,87.120.160.114,87.120.213.44,87.121.14.235,87.127.224.198,87.13.117.29,87.13.227.228,87.18.209.135,87.19.104.142,87.200.7.118,87.201.130.190,87.203.106.22,87.214.104.138,87.214.234.168,87.226.165.143,87.227.210.202,87.236.212.197,87.236.27.177,87.237.234.149,87.238.237.170,87.241.105.71,87.241.106.15,87.241.135.252,87.241.138.12,87.241.138.139,87.241.138.66,87.241.160.108,87.241.166.227,87.241.236.130,87.241.93.91,87.242.224.202,87.242.249.114] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 77"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403376; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [87.244.235.27,87.245.170.34,87.246.33.219,87.247.97.189,87.249.156.61,87.251.245.80,87.251.247.238,87.251.74.10,87.251.74.11,87.251.74.12,87.251.74.13,87.251.74.15,87.251.74.201,87.251.74.22,87.251.74.241,87.251.74.242,87.251.74.247,87.251.74.248,87.251.74.250,87.251.74.252,87.251.74.34,87.251.74.37,87.251.74.41,87.251.74.42,87.251.74.43,87.251.74.46,87.251.74.47,87.251.74.7,87.252.105.98,87.253.66.252,87.253.70.139,87.253.95.211,87.255.194.126,87.255.21.162,87.255.217.154,87.26.2.130,87.26.48.139,87.27.143.25,87.27.150.175,87.27.152.194,87.27.182.150,87.27.206.249,87.27.253.213,87.27.39.6,87.4.51.24,87.66.129.16,87.76.12.118,87.76.60.140,87.76.9.176,87.8.44.89] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 78"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403377; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [87.81.189.152,87.9.174.184,87.96.238.155,87.97.179.135,87.98.177.109,88.125.11.110,88.129.120.128,88.129.200.213,88.129.208.44,88.129.208.46,88.129.208.50,88.135.37.174,88.135.38.250,88.150.154.204,88.156.58.212,88.157.139.250,88.204.210.194,88.204.242.54,88.204.245.146,88.205.173.114,88.214.26.53,88.214.27.11,88.218.17.124,88.218.17.133,88.218.17.215,88.218.17.223,88.218.17.230,88.218.193.65,88.220.91.195,88.228.142.21,88.231.113.206,88.245.181.124,88.245.42.8,88.247.117.206,88.247.214.6,88.247.218.247,88.247.219.162,88.247.35.60,88.247.50.184,88.247.78.116,88.247.96.108,88.248.135.243,88.248.18.251,88.249.120.35,88.249.245.251,88.250.115.38,88.250.118.83,88.250.129.143,88.252.190.168,88.255.84.68] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 79"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403378; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [88.53.132.145,88.60.55.191,88.84.206.42,88.87.207.27,89.106.30.44,89.109.11.172,89.109.42.50,89.109.5.110,89.120.0.60,89.120.113.68,89.120.131.168,89.120.135.116,89.120.186.146,89.120.249.147,89.121.168.8,89.121.232.138,89.122.105.22,89.122.187.54,89.144.47.246,89.144.47.247,89.144.47.29,89.160.24.135,89.16.126.119,89.165.142.219,89.165.154.10,89.165.200.249,89.165.3.1,89.165.3.29,89.17.137.136,89.174.71.236,89.178.135.135,89.179.145.134,89.179.69.48,89.186.2.18,89.189.129.230,89.189.181.139,89.190.255.130,89.19.99.89,89.19.99.90,89.191.122.84,89.197.171.58,89.197.97.210,89.200.252.147,89.2.46.220,89.207.78.130,89.21.84.118,89.211.172.245,89.212.150.133,89.216.56.65,89.216.56.67] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 80"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403379; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [89.218.118.22,89.218.155.75,89.218.191.26,89.218.213.62,89.218.218.202,89.219.10.229,89.221.89.236,89.232.220.82,89.232.76.238,89.233.219.121,89.233.219.172,89.233.219.180,89.233.219.57,89.233.219.93,89.233.219.94,89.237.192.26,89.240.2.74,89.240.36.162,89.24.133.114,89.242.11.86,89.248.160.150,89.248.160.178,89.248.162.161,89.248.167.131,89.248.167.141,89.248.168.112,89.248.168.157,89.248.168.176,89.248.168.202,89.248.168.217,89.248.168.220,89.248.168.223,89.248.168.51,89.248.169.12,89.248.172.101,89.248.172.16,89.248.172.85,89.248.174.193,89.248.174.216,89.248.174.3,89.249.67.7,89.250.149.200,89.25.116.106,89.25.30.204,89.25.80.202,89.252.109.146,89.255.27.165,89.29.128.101,89.31.110.68,89.32.226.166] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 81"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403380; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [89.33.45.96,89.34.208.166,89.34.99.29,89.35.235.52,89.35.29.36,89.36.182.154,89.38.23.67,89.39.139.146,89.39.148.120,89.39.73.12,89.40.190.133,89.40.73.78,89.45.45.178,89.46.92.6,89.47.216.220,89.72.26.145,89.9.92.243,89.96.5.130,90.142.39.38,90.142.45.55,90.146.84.26,90.150.188.154,90.150.200.204,90.150.202.233,90.150.204.250,90.150.205.190,90.150.206.172,90.150.206.2,90.150.206.29,90.157.177.13,90.161.19.200,90.164.13.189,90.178.144.10,90.185.73.70,90.222.149.210,90.224.139.37,90.224.226.148,90.224.44.84,90.226.53.118,90.226.80.9,90.230.162.204,90.230.215.193,90.68.103.36,90.75.221.6,90.84.228.167,90.84.229.205,90.84.234.68,90.85.156.113,90.95.93.56,91.107.12.8] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 82"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403381; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [91.121.11.70,91.126.229.52,91.126.238.196,91.132.3.202,91.134.185.80,91.134.185.81,91.134.185.82,91.134.185.83,91.134.185.84,91.134.185.85,91.134.185.86,91.134.185.87,91.134.185.88,91.134.185.89,91.134.185.90,91.134.185.91,91.134.185.92,91.134.185.93,91.134.185.94,91.134.185.95,91.143.61.18,91.149.51.159,91.151.192.183,91.165.42.209,91.166.116.10,91.175.241.131,91.185.222.109,91.185.31.126,91.185.40.183,91.187.123.233,91.191.207.83,91.191.232.30,91.191.252.99,91.192.244.66,91.192.56.7,91.193.102.10,91.193.253.129,91.195.136.157,91.195.248.111,91.196.222.194,91.197.174.16,91.200.183.38,91.200.57.218,91.201.177.131,91.201.177.210,91.202.16.63,91.203.208.238,91.205.24.180,91.207.175.154,91.208.17.98] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 83"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403382; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [91.210.159.69,91.211.209.87,91.211.50.211,91.212.38.210,91.212.38.234,91.215.191.184,91.215.224.97,91.215.60.129,91.216.164.252,91.217.109.155,91.218.1.42,91.218.161.188,91.218.19.106,91.218.85.100,91.219.201.160,91.219.235.150,91.221.189.44,91.221.221.21,91.221.67.153,91.224.84.96,91.225.160.29,91.225.169.19,91.226.116.217,91.228.239.87,91.231.121.54,91.233.190.198,91.234.172.136,91.234.255.20,91.234.62.24,91.234.62.25,91.235.187.132,91.236.68.62,91.238.162.44,91.239.79.226,91.241.19.49,91.241.198.160,91.242.97.247,91.246.64.232,91.72.13.42,91.72.173.174,91.74.99.22,91.90.179.228,91.90.184.218,91.90.79.62,91.92.183.95,91.92.204.64,91.99.72.212,92.114.17.214,92.114.18.12,92.114.194.160] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 84"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403383; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [92.118.160.1,92.118.160.13,92.118.160.17,92.118.160.21,92.118.160.25,92.118.160.29,92.118.160.33,92.118.160.37,92.118.160.41,92.118.160.45,92.118.160.49,92.118.160.5,92.118.160.53,92.118.160.57,92.118.160.61,92.118.160.9,92.118.161.1,92.118.161.13,92.118.161.17,92.118.161.21,92.118.161.25,92.118.161.29,92.118.161.33,92.118.161.37,92.118.161.41,92.118.161.45,92.118.161.49,92.118.161.5,92.118.161.53,92.118.161.57,92.118.161.61,92.118.161.9,92.118.205.149,92.118.205.64,92.118.234.234,92.118.234.242,92.118.37.61,92.118.37.68,92.118.37.70,92.118.37.83,92.118.37.86,92.118.37.88,92.118.37.97,92.118.37.99,92.119.160.145,92.124.146.23,92.171.7.18,92.185.6.93,92.189.0.110,92.189.187.21] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 85"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403384; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [92.19.186.150,92.19.222.184,92.222.199.126,92.241.80.34,92.242.207.18,92.242.70.24,92.247.114.98,92.247.119.131,92.253.113.233,92.254.236.33,92.27.134.126,92.27.196.33,92.27.26.28,92.27.65.213,92.27.90.28,92.28.167.167,92.34.107.222,92.34.112.141,92.35.224.120,92.35.84.110,92.38.86.46,92.42.11.26,92.43.104.99,92.45.196.143,92.45.199.50,92.46.127.238,92.46.166.198,92.46.220.190,92.47.105.155,92.50.136.162,92.52.208.245,92.52.223.37,92.52.39.107,92.53.64.203,92.53.65.40,92.53.65.52,92.60.239.64,92.62.253.20,92.62.65.128,92.63.194.11,92.63.194.238,92.63.194.35,92.63.194.81,92.63.194.91,92.63.196.23,92.63.196.3,92.63.196.6,92.63.196.8,92.64.122.9,92.64.242.254] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 86"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403385; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [92.64.9.50,92.81.118.133,92.81.119.26,92.81.21.110,92.81.23.31,92.82.153.216,92.82.208.71,92.82.230.49,92.82.232.141,92.82.232.158,92.82.74.157,92.82.79.141,92.83.139.5,92.83.62.150,92.84.138.131,92.84.138.83,92.84.176.32,92.84.182.98,92.84.58.223,92.85.147.69,92.85.152.67,92.85.71.19,92.86.106.89,92.86.116.40,92.86.133.4,92.86.183.46,92.87.17.19,92.87.208.18,92.87.96.104,92.96.163.90,93.100.44.20,93.104.213.162,93.108.233.70,93.108.247.101,93.113.180.130,93.113.43.52,93.114.113.103,93.114.205.113,93.115.1.195,93.118.106.4,93.118.182.216,93.118.39.1,93.122.195.211,93.122.197.119,93.125.121.170,93.126.91.71,93.144.135.126,93.144.230.56,93.144.81.223,93.145.196.230] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 87"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403386; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [93.146.185.141,93.146.66.148,93.147.212.107,93.147.241.181,93.147.251.102,93.149.184.91,93.151.235.200,93.152.139.99,93.152.142.211,93.155.162.13,93.157.158.220,93.157.236.95,93.159.194.246,93.170.103.109,93.170.48.5,93.171.185.39,93.171.5.244,93.171.79.130,93.174.93.10,93.174.93.27,93.174.95.106,93.174.95.73,93.175.86.217,93.176.154.141,93.184.200.92,93.185.66.17,93.185.66.18,93.185.66.21,93.186.254.240,93.190.21.90,93.191.103.109,93.222.184.225,93.26.118.5,93.37.235.143,93.38.115.177,93.39.189.90,93.39.230.232,93.39.97.39,93.41.129.126,93.41.157.9,93.41.182.232,93.41.225.231,93.42.109.154,93.42.155.129,93.42.250.149,93.42.75.163,93.43.219.6,93.46.112.134,93.46.185.100,93.47.154.33] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 88"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403387; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [93.47.173.122,93.47.206.120,93.48.49.66,93.49.0.93,93.5.225.70,93.51.51.36,93.51.71.137,93.54.87.238,93.55.176.37,93.55.250.18,93.56.68.41,93.57.30.14,93.62.253.230,93.62.253.231,93.62.254.109,93.63.167.107,93.64.215.66,93.64.87.138,93.65.227.81,93.65.250.233,93.66.138.137,93.66.139.130,93.66.54.57,93.67.134.47,93.67.176.190,93.67.249.237,93.67.255.176,93.70.225.249,93.71.247.71,93.71.9.21,93.76.188.132,93.76.241.240,93.77.244.51,93.78.217.218,93.79.102.220,93.79.1.2,93.87.76.170,93.87.76.172,93.87.76.53,93.87.76.74,93.91.150.237,93.94.219.202,93.99.41.100,93.99.52.27,94.0.134.128,94.10.48.129,94.101.60.219,94.102.125.224,94.102.49.114,94.102.49.137] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 89"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403388; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [94.102.49.190,94.102.49.193,94.102.49.29,94.102.50.103,94.102.51.31,94.102.52.57,94.102.56.151,94.102.56.181,94.102.56.215,94.102.60.18,94.102.60.19,94.130.59.165,94.13.235.33,94.138.130.19,94.138.130.20,94.138.130.21,94.138.130.34,94.142.35.130,94.15.36.189,94.15.71.154,94.153.144.58,94.154.26.126,94.156.75.20,94.158.245.21,94.168.108.154,94.168.86.178,94.177.224.182,94.179.129.148,94.180.121.34,94.180.25.94,94.183.165.103,94.183.231.81,94.183.87.121,94.187.148.21,94.19.199.235,94.19.29.200,94.19.45.164,94.191.31.253,94.191.58.198,94.191.60.150,94.198.187.114,94.198.188.18,94.198.189.222,94.198.190.142,94.198.190.74,94.199.30.230,94.200.107.2,94.200.179.62,94.200.211.242,94.205.239.99] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 90"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403389; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [94.205.66.58,94.206.164.244,94.21.0.251,94.225.237.5,94.228.26.22,94.23.176.17,94.23.49.58,94.231.130.172,94.231.164.168,94.236.200.194,94.236.253.230,94.24.229.218,94.242.222.57,94.244.140.95,94.244.31.200,94.245.20.160,94.253.12.176,94.254.23.186,94.254.48.193,94.254.74.39,94.255.187.135,94.255.247.17,94.255.247.18,94.255.247.25,94.255.247.4,94.255.247.9,94.41.157.193,94.41.84.3,94.41.97.163,94.45.121.217,94.46.223.163,94.50.162.191,94.53.196.70,94.59.140.48,94.59.187.211,94.60.161.209,94.60.242.131,94.60.243.214,94.65.11.141,94.65.246.112,94.66.0.192,94.67.160.105,94.67.207.12,94.67.80.116,94.68.66.39,94.69.60.159,94.70.165.96,94.71.92.155,94.71.97.168,94.77.225.243] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 91"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403390; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [94.79.55.196,94.89.40.90,94.97.42.181,95.104.78.143,95.105.52.21,95.106.159.234,95.107.198.103,95.107.32.81,95.111.116.183,95.128.242.174,95.129.183.71,95.13.33.13,95.131.10.118,95.134.195.166,95.137.150.86,95.140.40.90,95.14.152.120,95.141.135.171,95.141.142.154,95.141.142.46,95.141.225.114,95.141.37.69,95.141.44.106,95.142.84.234,95.144.137.216,95.154.77.69,95.155.12.59,95.155.237.90,95.155.36.152,95.161.158.195,95.161.7.188,95.165.141.191,95.165.142.201,95.165.166.151,95.165.219.222,95.165.243.162,95.168.171.165,95.169.214.169,95.170.187.190,95.188.95.147,95.189.109.183,95.213.177.123,95.213.177.124,95.213.177.125,95.213.177.126,95.217.183.163,95.217.190.106,95.217.214.220,95.217.214.221,95.217.214.222] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 92"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403391; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [95.217.214.223,95.217.214.225,95.217.214.226,95.217.214.227,95.217.214.228,95.229.149.107,95.231.144.232,95.232.157.4,95.234.236.101,95.236.81.140,95.242.178.12,95.246.12.141,95.246.47.102,95.247.118.163,95.252.220.47,95.255.100.89,95.255.31.198,95.255.82.116,95.255.93.189,95.31.241.178,95.31.253.200,95.38.61.185,95.42.209.45,95.43.223.127,95.45.98.87,95.47.248.123,95.51.186.245,95.51.224.2,95.52.231.57,95.56.205.26,95.57.218.103,95.57.99.135,95.59.137.130,95.59.143.29,95.6.21.60,95.6.42.186,95.65.43.3,95.67.13.186,95.69.254.20,95.71.126.178,95.71.148.250,95.76.103.219,95.77.10.14,95.77.118.131,95.77.126.206,95.77.99.180,95.79.101.229,95.80.108.79,95.80.108.8,95.80.87.83] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 93"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403392; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [95.85.12.122,95.85.85.5,95.87.15.137,95.87.29.136,95.87.37.103,95.9.116.157,95.9.139.200,95.9.143.252,95.9.145.210,95.9.229.135,95.9.248.2,95.9.50.46,95.97.42.186,96.224.32.210,96.234.20.218,96.238.63.166,96.242.174.18,96.246.180.213,96.250.98.103,96.255.250.230,96.29.218.228,96.36.101.238,96.39.47.154,96.41.29.228,96.43.169.37,96.47.122.230,96.48.158.15,96.56.150.24,96.56.205.210,96.66.125.214,96.66.204.241,96.68.124.117,96.68.45.185,96.68.92.22,96.71.40.62,96.71.79.205,96.72.177.137,96.73.119.66,96.73.56.75,96.75.123.186,96.75.133.125,96.76.174.161,96.79.191.133,96.80.238.22,96.80.251.85,96.80.89.253,96.81.166.84,96.81.49.9,96.82.134.211,96.84.182.170] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 94"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403393; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [96.85.147.237,96.86.107.113,96.87.237.210,96.87.61.117,96.88.59.245,96.88.66.73,96.90.11.113,96.90.167.53,96.90.8.209,96.9.72.40,96.9.78.45,96.93.215.217,97.105.129.229,97.105.15.251,97.105.39.161,97.105.61.172,97.71.137.75,97.74.229.113,97.75.141.117,97.75.239.232,97.76.88.18,97.77.7.231,97.90.58.34,97.93.250.114,98.100.143.234,98.116.230.2,98.126.159.150,98.126.16.126,98.126.7.234,98.128.130.63,98.14.117.172,98.142.163.244,98.164.140.222,98.175.176.145,98.191.6.172,98.202.0.134,98.211.211.31,98.212.185.248,98.213.192.2,98.217.127.52,98.222.153.221,98.224.134.64,98.23.122.25,98.254.122.118,98.30.160.158,98.4.191.90,98.5.117.188,98.6.162.66,98.6.198.194,98.6.205.218] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 95"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403394; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [98.6.213.242,98.6.214.182,98.6.233.50,99.1.237.68,99.105.91.245,99.106.27.205,99.13.124.52,99.229.179.186,99.239.176.60,99.239.188.27,99.243.16.225,99.245.114.77,99.245.23.207,99.255.208.105,99.44.78.234,99.67.57.104,99.97.218.164,100.24.71.236,100.33.109.99,100.33.112.5,100.33.91.173,100.38.102.191,100.38.122.182,100.38.240.68,100.40.15.74,100.8.47.129,100.8.77.59,100.8.79.226,100.8.86.166,101.108.108.231,101.109.119.58,101.109.250.103,101.109.253.59,101.128.239.102,101.128.73.26,101.128.74.157,101.128.77.240,101.142.110.74,101.16.160.137,101.188.109.139,101.200.210.27,101.203.172.89,101.203.175.192,101.224.30.202,101.226.241.74,101.227.38.37,101.230.8.148,101.234.76.77,101.251.192.61,101.251.241.81] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 96"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403395; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [101.251.241.82,101.251.99.49,101.254.115.180,101.254.147.190,101.254.182.206,101.254.192.54,101.254.208.9,101.255.122.9,101.30.158.178,101.36.138.132,101.36.138.88,101.36.148.82,101.36.160.246,101.36.179.159,101.50.57.47,101.51.12.151,101.53.100.115,101.53.101.16,101.53.102.102,101.64.145.187,101.67.109.15,101.69.206.211,101.70.26.239,101.78.0.236,101.83.252.212,101.85.191.106,101.85.248.112,101.89.67.29,101.89.91.176,101.95.111.142,101.95.188.82,101.98.102.7,101.99.52.220,101.99.53.200,101.99.7.235,102.129.224.132,102.152.62.153,102.164.44.243,102.189.202.32,103.100.209.176,103.100.209.58,103.100.210.64,103.100.211.16,103.10.87.54,103.103.88.242,103.105.56.193,103.105.56.50,103.106.148.120,103.106.211.126,103.106.236.213] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 97"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403396; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [103.107.198.78,103.107.245.45,103.107.63.236,103.110.132.153,103.114.104.233,103.114.104.241,103.114.107.129,103.117.192.87,103.117.60.14,103.118.95.82,103.119.104.206,103.119.105.47,103.119.144.218,103.121.90.58,103.122.110.114,103.122.32.118,103.123.65.22,103.126.24.82,103.127.28.105,103.129.222.135,103.129.64.159,103.130.214.172,103.131.169.157,103.131.180.193,103.132.95.122,103.133.107.234,103.133.109.142,103.135.160.130,103.136.42.77,103.136.75.213,103.138.10.6,103.138.108.120,103.138.206.41,103.139.44.122,103.139.45.115,103.140.183.250,103.141.234.41,103.143.208.215,103.144.148.171,103.145.12.25,103.145.12.29,103.145.12.43,103.145.12.48,103.145.12.50,103.145.12.58,103.145.12.59,103.145.12.65,103.145.12.75,103.145.12.80,103.145.13.10] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 98"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403397; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [103.145.13.11,103.145.13.12,103.145.13.14,103.145.13.4,103.145.13.5,103.145.13.6,103.145.13.8,103.145.13.9,103.145.253.87,103.146.11.62,103.146.74.1,103.15.140.126,103.15.140.140,103.15.74.152,103.16.199.133,103.16.202.160,103.17.100.229,103.17.88.36,103.18.162.231,103.193.191.30,103.195.238.155,103.195.4.139,103.195.5.51,103.196.127.210,103.196.46.251,103.199.99.134,103.200.4.82,103.200.56.29,103.20.212.240,103.20.30.203,103.204.221.5,103.205.180.57,103.205.56.93,103.205.7.98,103.206.170.33,103.207.170.53,103.207.56.201,103.209.100.238,103.210.170.8,103.21.149.102,103.21.149.92,103.214.141.136,103.214.157.69,103.214.229.236,103.215.245.163,103.215.80.70,103.216.216.115,103.218.242.190,103.219.112.1,103.219.112.31] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 99"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403398; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [103.219.112.48,103.219.112.63,103.219.29.56,103.219.32.147,103.219.36.44,103.221.252.34,103.224.6.107,103.226.169.145,103.226.186.130,103.226.207.20,103.226.7.141,103.228.204.238,103.228.45.34,103.228.53.17,103.228.53.59,103.229.147.235,103.230.110.229,103.230.111.90,103.230.180.41,103.230.239.230,103.231.209.227,103.231.252.120,103.231.42.28,103.233.4.29,103.233.76.246,103.234.21.3,103.234.21.6,103.234.21.76,103.235.169.188,103.236.193.242,103.236.254.18,103.238.200.62,103.239.165.42,103.239.252.66,103.240.100.100,103.240.77.52,103.241.164.30,103.242.0.129,103.242.225.238,103.242.239.123,103.245.198.246,103.246.113.65,103.246.113.9,103.247.158.126,103.247.218.41,103.247.227.3,103.248.83.226,103.249.192.79,103.249.87.182,103.250.147.209] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 100"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403399; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)