ciarmy.rules

#
# $Id: emerging-ciarmy.rules $
# Emerging Threats Ciarmy rules.
#
# Rules to block CiArmy.com identified Top Attackers (www.ciarmy.com)
#
# More information available at www.emergingthreats.net
#
# Please submit any feedback or ideas to emerging@emergingthreats.net or the emerging-sigs mailing list
#
#*************************************************************
#
#  Copyright (c) 2003-2019, Emerging Threats
#  All rights reserved.
#  
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the 
#  following conditions are met:
#  
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following 
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the 
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived 
#    from this software without specific prior written permission.
#  
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, 
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
#
#
alert ip [1.11.100.135,1.168.120.198,1.171.10.247,1.171.145.253,1.173.225.177,1.174.25.6,1.174.74.150,1.179.128.124,1.179.153.18,1.179.173.2,1.179.199.114,1.186.220.253,1.188.193.211,1.189.79.7,1.189.88.70,1.192.131.153,1.192.192.4,1.192.192.6,1.192.192.8,1.192.195.11,1.192.195.5,1.192.195.8,1.193.112.135,1.196.216.140,1.202.128.68,1.202.156.201,1.202.240.163,1.203.115.140,1.203.115.64,1.203.161.58,1.203.65.156,1.203.80.2,1.203.93.254,1.207.63.62,1.209.72.151,1.209.72.154,1.214.245.27,1.222.141.242,1.224.166.120,1.224.166.240,1.227.37.35,1.227.5.115,1.231.158.6,1.238.61.87,1.243.12.150,1.245.218.13,1.245.248.204,1.249.31.138,1.250.176.173,1.250.176.181] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 1"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403300; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [1.250.239.46,1.252.1.43,1.26.137.149,1.29.26.230,1.31.92.70,1.32.238.18,1.32.249.100,1.32.249.34,1.34.0.39,1.34.129.14,1.34.140.51,1.34.143.172,1.34.160.50,1.34.161.7,1.34.171.205,1.34.174.109,1.34.179.172,1.34.194.23,1.34.197.179,1.34.213.33,1.34.217.33,1.34.27.155,1.34.83.79,1.34.96.239,1.36.105.88,1.36.167.137,1.36.21.130,1.36.56.102,1.4.181.133,1.4.191.230,1.52.134.44,1.52.29.73,1.52.58.248,1.53.147.235,1.53.252.17,1.53.32.201,1.54.221.9,1.55.252.180,1.56.207.130,1.56.207.131,1.62.117.4,1.63.10.177,1.63.226.82,1.63.3.16,1.64.108.180,1.64.109.147,1.64.132.68,1.64.144.195,1.64.189.213,1.64.189.27] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 2"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403301; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [1.64.51.155,1.65.131.209,1.65.139.180,1.65.152.196,1.65.157.99,1.69.204.36,1.69.76.210,1.71.191.178,2.110.41.186,2.132.171.171,2.132.249.34,2.133.85.228,2.135.237.28,2.136.161.213,2.136.165.103,2.136.182.204,2.136.191.82,2.136.64.237,2.180.28.2,2.180.31.138,2.180.37.80,2.180.8.67,2.207.135.70,2.226.152.75,2.227.228.222,2.229.110.184,2.229.123.30,2.232.146.200,2.235.159.160,2.237.163.161,2.237.2.161,2.237.250.31,2.237.6.173,2.238.148.8,2.238.32.42,2.239.139.239,2.249.177.216,2.32.26.67,2.35.104.118,2.35.179.41,2.36.218.122,2.38.157.22,2.38.184.254,2.38.185.198,2.39.173.31,2.39.238.49,2.42.14.41,2.42.207.248,2.45.240.226,2.47.113.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 3"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403302; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [2.47.179.38,2.47.198.217,2.50.125.47,2.50.157.136,2.50.168.44,2.50.182.81,2.50.34.1,2.58.228.167,2.59.146.22,2.61.248.243,2.61.251.97,2.81.219.150,2.85.44.52,2.86.68.151,3.135.249.67,3.231.147.49,3.80.170.246,3.81.60.82,3.89.212.33,3.90.178.48,3.94.250.69,3.95.32.131,4.34.133.66,5.100.61.211,5.101.0.209,5.102.58.45,5.11.71.7,5.129.145.176,5.129.14.77,5.133.168.15,5.135.120.247,5.135.253.172,5.140.165.39,5.14.229.170,5.149.223.181,5.15.241.55,5.151.118.100,5.151.13.157,5.152.207.195,5.159.228.68,5.164.31.236,5.172.189.138,5.172.25.16,5.180.76.156,5.182.211.152,5.182.211.180,5.182.211.181,5.182.211.184,5.183.101.155,5.183.181.86] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 4"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403303; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [5.187.160.235,5.187.211.214,5.188.210.158,5.188.210.190,5.189.131.63,5.189.134.204,5.189.148.136,5.189.167.107,5.189.23.195,5.19.235.186,5.196.30.151,5.199.145.92,5.200.64.54,5.200.77.90,5.2.202.88,5.21.60.124,5.219.45.176,5.233.47.124,5.253.16.121,5.32.68.226,5.32.86.98,5.34.179.23,5.39.200.102,5.39.216.148,5.42.118.38,5.44.197.24,5.44.206.147,5.56.27.145,5.57.249.2,5.65.112.9,5.79.193.51,5.79.82.19,5.81.76.102,5.88.122.58,5.88.130.165,5.89.112.6,5.89.175.250,5.89.59.163,5.95.35.109,5.95.73.175,8.208.16.219,8.208.80.126,8.209.67.241,8.209.78.24,8.3.127.247,8.42.79.215,11.11.3.191,12.156.112.9,12.166.193.125,12.178.187.6] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 5"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403304; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [12.178.187.7,12.178.187.8,12.178.187.9,12.188.20.242,12.192.164.250,12.197.133.114,12.203.180.37,12.208.103.106,12.21.84.50,12.221.234.155,12.235.36.252,12.34.218.243,12.36.54.66,12.88.142.206,13.230.186.61,13.65.201.223,13.71.92.210,14.10.34.1,14.102.254.230,14.102.30.118,14.102.71.10,14.116.160.67,14.116.188.151,14.117.184.202,14.127.251.189,14.128.34.34,14.136.134.20,14.136.175.3,14.136.211.137,14.136.249.138,14.136.249.140,14.136.49.112,14.136.80.242,14.139.110.164,14.139.171.130,14.141.111.154,14.141.64.104,14.141.67.86,14.143.114.163,14.152.100.147,14.161.0.218,14.161.10.81,14.161.1.251,14.161.13.217,14.161.31.125,14.161.32.108,14.161.32.122,14.161.42.135,14.161.46.100,14.161.4.63] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 6"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403305; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [14.164.26.111,14.168.143.170,14.17.100.33,14.17.100.57,14.17.114.65,14.173.230.52,14.176.232.103,14.177.232.175,14.177.236.108,14.18.118.232,14.18.248.3,14.181.74.160,14.184.112.26,14.186.161.148,14.186.57.130,14.188.164.230,14.189.228.78,14.191.11.163,14.191.211.188,14.192.240.143,14.198.135.180,14.198.46.23,14.202.114.24,14.204.211.122,14.207.101.13,14.207.113.190,14.21.18.57,14.21.85.18,14.225.19.81,14.227.84.0,14.230.47.222,14.23.37.162,14.23.50.218,14.231.178.198,14.231.93.166,14.232.155.94,14.232.160.2,14.232.208.115,14.232.208.235,14.232.245.36,14.237.142.62,14.237.218.171,14.238.7.6,14.241.231.79,14.241.251.217,14.241.67.202,14.248.114.236,14.253.173.76,14.255.71.90,14.29.137.186] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 7"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403306; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [14.29.184.152,14.29.214.3,14.29.244.7,14.33.211.12,14.33.212.145,14.33.35.138,14.34.189.136,14.34.227.102,14.35.19.181,14.36.117.15,14.36.163.165,14.37.10.144,14.38.133.217,14.39.208.75,14.39.246.130,14.40.63.243,14.42.155.38,14.42.33.245,14.42.74.230,14.42.80.24,14.43.173.208,14.44.96.65,14.44.97.33,14.45.132.44,14.45.175.87,14.46.40.196,14.46.81.47,14.47.20.195,14.47.77.176,14.48.97.168,14.49.135.191,14.5.165.7,14.52.111.32,14.53.193.76,14.53.43.12,14.54.113.164,14.54.176.243,14.55.144.142,14.78.109.175,15.165.76.150,18.188.244.162,18.206.180.29,18.219.102.7,18.219.134.226,18.224.116.199,18.232.60.254,18.232.98.238,20.1.2.2,20.42.105.91,23.108.217.156] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 8"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403307; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [23.113.104.137,23.116.185.114,23.160.192.87,23.224.37.18,23.225.148.210,23.226.54.2,23.228.238.156,23.231.25.234,23.234.14.159,23.234.51.226,23.234.52.210,23.236.76.45,23.239.5.151,23.24.170.173,23.241.142.52,23.244.43.90,23.244.53.2,23.245.26.252,23.248.188.94,23.251.84.126,23.252.41.74,23.30.163.61,23.30.53.161,23.30.63.253,23.31.209.205,23.88.137.2,23.89.251.218,23.89.88.2,23.94.122.108,23.94.173.238,23.94.179.104,23.94.182.210,23.95.191.195,23.95.8.16,24.106.125.38,24.106.36.242,24.106.36.74,24.111.179.6,24.118.95.131,24.119.52.56,24.129.157.58,24.129.170.35,24.132.92.8,24.136.3.188,24.149.10.29,24.165.25.22,24.181.67.58,24.182.196.46,24.184.79.176,24.186.140.196] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 9"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403308; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [24.187.199.142,24.188.5.96,24.193.135.2,24.200.159.124,24.203.3.167,24.206.4.29,24.209.156.27,24.212.15.149,24.212.240.29,24.213.8.101,24.217.116.164,24.220.73.91,24.224.145.161,24.232.235.120,24.234.48.230,24.244.144.145,24.38.235.234,24.41.166.50,24.42.143.162,24.42.19.24,24.42.229.143,24.42.240.210,24.42.55.108,24.64.194.214,24.7.156.134,24.84.159.15,24.87.132.29,24.93.200.253,24.96.155.223,24.96.212.159,24.97.43.195,27.102.129.22,27.104.193.30,27.104.228.249,27.105.198.188,27.109.137.192,27.109.186.79,27.111.36.254,27.113.3.47,27.113.68.229,27.115.124.10,27.115.124.74,27.115.124.75,27.115.124.9,27.115.252.189,27.116.126.169,27.116.18.109,27.116.38.166,27.12.12.217,27.124.2.123] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 10"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403309; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [27.13.237.18,27.13.96.23,27.131.178.119,27.142.249.93,27.147.142.53,27.147.40.16,27.151.0.205,27.151.29.191,27.151.29.56,27.154.69.10,27.155.83.174,27.155.87.178,27.159.122.176,27.17.35.34,27.188.208.8,27.189.251.228,27.191.150.46,27.193.249.146,27.197.61.153,27.198.10.136,27.199.156.212,27.208.235.148,27.209.161.166,27.214.109.125,27.215.59.76,27.221.25.235,27.223.107.146,27.223.90.210,27.223.94.122,27.252.53.160,27.252.57.41,27.254.130.97,27.254.174.209,27.254.34.181,27.254.64.87,27.254.67.162,27.255.40.150,27.3.135.30,27.3.178.12,27.35.18.93,27.38.37.76,27.48.138.8,27.49.160.7,27.49.160.8,27.49.160.9,27.49.232.7,27.49.232.9,27.49.64.14,27.50.25.211,27.68.103.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 11"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403310; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [27.68.39.70,27.71.138.41,27.72.102.234,27.72.103.62,27.72.104.175,27.72.105.47,27.72.148.10,27.72.149.73,27.72.164.185,27.72.164.250,27.72.74.143,27.72.80.126,27.72.88.125,27.72.95.38,27.73.111.77,27.74.139.193,27.74.241.170,27.74.242.47,27.74.245.44,27.74.251.241,27.74.254.2,27.75.114.243,27.75.208.78,27.75.43.10,27.76.200.188,27.76.200.86,27.76.247.30,27.77.137.79,27.77.188.213,27.78.186.44,27.78.26.72,27.78.87.109,27.8.192.209,27.8.4.208,27.92.117.238,31.129.70.189,31.129.82.101,31.13.131.138,31.13.32.226,31.133.207.227,31.134.209.80,31.134.32.52,31.135.30.132,31.14.136.214,31.14.139.155,31.14.16.248,31.14.184.2,31.146.84.142,31.156.217.180,31.156.70.28] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 12"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403311; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [31.163.129.85,31.163.130.200,31.163.132.182,31.163.146.178,31.163.146.217,31.163.154.80,31.163.157.230,31.163.159.196,31.163.160.113,31.163.160.180,31.163.163.127,31.163.163.97,31.163.164.228,31.163.168.9,31.163.169.25,31.163.170.170,31.163.175.70,31.163.176.22,31.163.177.156,31.163.180.66,31.163.184.200,31.163.184.216,31.168.184.82,31.171.69.250,31.172.178.181,31.173.125.143,31.186.48.172,31.207.45.90,31.207.47.48,31.208.133.145,31.208.166.61,31.208.190.94,31.208.193.240,31.208.204.215,31.208.235.134,31.208.252.216,31.23.165.126,31.25.132.230,31.25.90.227,31.27.149.45,31.28.238.187,31.31.72.164,31.31.75.212,31.31.91.111,31.42.165.227,31.47.43.139,31.5.167.62,34.203.222.103,34.207.73.231,34.229.187.158] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 13"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403312; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [34.67.254.99,34.68.217.179,34.69.48.89,34.71.232.44,34.71.95.229,34.80.135.20,34.80.153.175,34.80.51.84,34.80.83.131,34.82.202.253,34.84.185.118,34.84.82.184,34.85.95.77,34.85.97.252,34.87.165.209,34.87.24.216,34.87.95.122,34.89.122.124,34.90.159.83,34.91.64.196,34.92.115.242,34.92.255.52,34.92.31.13,34.92.63.3,34.93.85.18,34.94.204.192,34.94.225.64,34.95.150.205,34.95.252.156,34.96.133.169,34.96.166.35,34.96.217.139,34.96.247.114,35.175.255.49,35.188.62.96,35.189.42.166,35.197.203.96,35.197.227.71,35.203.51.216,35.203.85.214,35.220.130.113,35.220.169.26,35.220.206.213,35.220.210.160,35.222.233.6,35.222.24.235,35.228.13.240,35.228.174.126,35.229.214.34,35.229.216.125] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 14"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403313; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [35.234.74.221,35.234.82.66,35.236.148.112,35.239.182.3,35.240.157.102,35.241.72.43,35.243.218.129,36.103.229.37,36.103.241.148,36.104.145.203,36.108.168.81,36.110.105.52,36.110.182.30,36.110.218.194,36.110.218.196,36.110.3.50,36.110.41.66,36.110.44.187,36.110.64.84,36.111.150.124,36.112.101.130,36.112.138.185,36.112.26.54,36.112.41.194,36.112.66.234,36.153.221.82,36.153.23.162,36.153.23.163,36.153.23.168,36.153.23.171,36.153.23.184,36.153.23.186,36.154.117.210,36.154.8.19,36.22.187.34,36.225.98.68,36.228.87.231,36.233.65.79,36.236.10.142,36.237.11.188,36.237.204.40,36.248.182.205,36.250.75.44,36.251.182.193,36.255.220.125,36.255.223.102,36.26.134.125,36.26.64.143,36.27.79.124,36.33.140.46] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 15"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403314; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [36.33.94.86,36.37.115.106,36.38.59.139,36.41.184.69,36.46.136.67,36.48.159.58,36.48.166.77,36.52.213.123,36.66.133.87,36.66.249.242,36.66.76.165,36.67.167.19,36.67.205.67,36.67.206.55,36.67.88.27,36.7.175.187,36.7.80.168,36.7.82.194,36.7.87.6,36.72.129.148,36.72.217.50,36.85.86.187,36.89.232.235,36.89.251.105,36.91.123.210,36.91.175.212,36.92.18.191,36.92.92.42,37.104.160.145,37.105.131.203,37.105.238.187,37.106.170.150,37.106.175.35,37.11.74.18,37.112.157.251,37.116.253.122,37.117.129.128,37.120.146.76,37.120.249.77,37.130.119.63,37.131.208.141,37.131.222.41,37.139.105.177,37.139.99.58,37.144.102.164,37.156.146.132,37.156.147.69,37.159.137.186,37.17.250.101,37.179.145.116] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 16"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403315; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [37.189.3.63,37.191.192.155,37.191.197.157,37.191.232.6,37.193.119.50,37.193.123.110,37.193.123.141,37.193.175.55,37.193.216.194,37.203.147.147,37.203.156.214,37.203.175.66,37.206.130.116,37.208.66.110,37.224.21.161,37.224.21.163,37.224.22.243,37.228.137.243,37.228.65.237,37.229.72.49,37.229.85.211,37.232.180.177,37.233.53.184,37.233.55.0,37.233.60.56,37.235.186.160,37.235.86.14,37.235.87.163,37.238.136.74,37.252.65.22,37.252.69.104,37.252.69.119,37.252.86.62,37.252.87.15,37.255.187.200,37.255.197.241,37.255.197.65,37.26.2.122,37.26.9.108,37.28.161.146,37.29.110.183,37.29.82.227,37.32.46.25,37.34.187.254,37.34.228.1,37.34.245.237,37.46.33.146,37.49.225.166,37.49.226.107,37.49.226.111] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 17"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403316; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [37.49.226.117,37.49.226.118,37.49.226.132,37.49.226.133,37.49.226.134,37.49.226.135,37.49.226.141,37.49.226.16,37.49.226.160,37.49.226.161,37.49.226.241,37.49.226.250,37.49.226.3,37.49.226.4,37.49.226.7,37.49.227.109,37.49.230.14,37.49.230.180,37.49.231.145,37.52.68.220,37.53.232.164,37.54.213.187,37.55.70.27,37.6.248.104,37.72.0.205,37.79.142.65,37.79.255.19,38.109.112.81,38.112.61.248,38.117.105.179,38.123.196.230,38.65.250.6,38.69.233.7,38.83.107.236,39.100.115.10,39.100.224.53,39.104.163.128,39.104.21.120,39.106.67.100,39.106.89.199,39.109.114.159,39.109.202.126,39.109.223.10,39.112.101.126,39.113.197.251,39.113.202.40,39.118.111.86,39.119.230.52,39.129.118.30,39.134.26.20] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 18"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403317; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [39.150.61.109,39.152.57.62,39.153.135.16,39.153.252.196,39.155.137.126,39.155.222.2,39.164.161.51,39.164.205.16,39.37.200.193,39.42.57.234,39.46.13.184,39.61.33.16,39.69.190.90,39.69.95.38,39.76.234.10,39.77.25.187,39.77.70.12,39.86.189.230,39.88.153.105,39.90.78.82,39.96.56.35,39.98.200.82,39.98.75.99,40.118.1.129,40.132.4.75,40.69.191.102,40.71.206.241,41.110.24.21,41.128.168.39,41.129.43.88,41.138.57.244,41.138.88.26,41.139.12.151,41.139.248.45,41.140.253.4,41.149.156.93,41.155.244.120,41.160.231.12,41.162.61.106,41.170.93.142,41.189.186.163,41.204.84.182,41.208.73.21,41.21.233.230,41.21.238.5,41.213.192.168,41.218.224.119,41.219.185.234,41.221.251.19,41.221.52.130] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 19"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403318; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [41.222.232.227,41.224.249.60,41.225.58.25,41.226.32.137,41.230.32.213,41.32.124.181,41.32.133.153,41.32.153.100,41.32.17.167,41.32.187.131,41.33.146.1,41.33.188.148,41.33.210.78,41.33.240.117,41.33.37.150,41.38.121.79,41.38.165.34,41.38.50.50,41.39.49.181,41.39.53.198,41.39.55.49,41.41.153.43,41.41.186.99,41.41.5.10,41.41.71.195,41.41.77.196,41.59.251.246,41.59.82.140,41.63.8.13,41.65.182.136,41.65.218.72,41.65.68.70,41.72.61.43,41.73.3.190,41.75.81.26,41.75.86.18,41.76.168.83,41.76.169.8,41.76.8.12,41.78.172.77,41.78.26.18,41.79.196.246,41.82.189.133,41.82.224.162,41.89.198.249,41.92.133.214,41.93.40.87,42.101.48.131,42.102.144.81,42.113.90.187] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 20"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403319; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [42.115.148.209,42.115.193.128,42.115.250.31,42.115.32.189,42.115.52.206,42.116.29.44,42.117.168.210,42.117.197.240,42.117.69.246,42.119.204.235,42.119.29.161,42.123.99.67,42.157.162.14,42.179.128.214,42.179.94.31,42.187.123.122,42.189.17.22,42.200.129.185,42.200.137.178,42.200.198.230,42.200.236.169,42.2.158.161,42.2.48.166,42.2.65.112,42.202.133.2,42.224.86.170,42.225.178.117,42.226.125.107,42.228.2.150,42.228.58.107,42.230.123.198,42.230.207.98,42.235.149.100,42.236.10.112,42.236.10.72,42.236.73.90,42.236.74.70,42.236.82.143,42.236.82.184,42.236.91.186,42.237.60.193,42.247.16.101,42.247.5.68,42.247.5.71,42.247.5.75,42.247.5.76,42.247.5.80,42.247.5.84,42.247.5.87,42.247.5.93] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 21"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403320; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [42.247.7.169,42.249.8.118,42.3.141.166,42.3.4.55,42.4.0.212,42.4.253.79,42.48.104.96,42.48.60.89,42.51.223.101,42.51.223.103,42.51.225.175,42.51.64.190,42.55.69.77,42.58.181.106,42.62.107.209,42.62.18.252,42.62.2.130,42.62.24.243,42.62.96.36,42.81.122.86,42.81.123.232,42.81.142.146,42.82.237.144,42.82.237.8,42.84.201.65,42.98.194.98,42.98.51.170,43.224.180.205,43.224.252.233,43.225.159.106,43.225.167.166,43.226.35.167,43.226.49.116,43.226.49.84,43.226.67.8,43.228.38.174,43.228.79.13,43.228.79.40,43.228.79.41,43.228.79.43,43.230.144.10,43.230.144.22,43.230.144.66,43.230.146.191,43.231.185.29,43.240.10.72,43.240.117.208,43.240.117.223,43.240.136.228,43.240.137.16] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 22"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403321; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [43.241.110.15,43.241.111.41,43.242.214.183,43.242.34.38,43.243.136.253,43.243.168.63,43.243.168.98,43.245.222.163,43.245.222.176,43.245.222.88,43.245.234.76,43.246.174.220,43.246.175.119,43.247.184.225,43.247.184.39,43.247.68.12,43.248.124.113,43.250.106.18,43.250.186.190,43.250.186.82,43.250.187.166,43.250.187.22,43.250.80.170,43.252.195.66,43.252.66.131,43.254.213.71,43.254.240.150,43.254.240.34,43.255.217.140,45.112.247.15,45.113.68.179,45.113.69.175,45.113.70.144,45.113.70.223,45.113.70.231,45.113.70.37,45.113.71.101,45.113.71.103,45.113.71.200,45.113.71.209,45.113.71.23,45.113.71.236,45.114.10.158,45.114.85.202,45.115.236.30,45.115.243.34,45.116.160.31,45.116.191.172,45.117.176.23,45.117.42.125] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 23"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403322; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.119.82.251,45.121.144.114,45.121.144.203,45.122.138.23,45.122.221.69,45.122.246.127,45.122.246.176,45.122.46.2,45.123.97.24,45.123.97.25,45.124.19.82,45.125.217.193,45.125.218.10,45.125.44.134,45.125.65.74,45.125.66.204,45.126.121.75,45.127.133.94,45.127.134.32,45.127.186.21,45.127.96.75,45.127.96.99,45.127.97.45,45.127.97.47,45.130.2.198,45.13.93.82,45.13.93.90,45.134.179.243,45.134.179.57,45.134.179.87,45.134.179.88,45.134.217.139,45.135.236.2,45.136.108.35,45.136.108.85,45.136.109.251,45.14.150.133,45.14.150.52,45.141.85.106,45.141.87.24,45.143.220.112,45.143.220.125,45.143.220.127,45.143.220.133,45.143.220.134,45.143.220.138,45.143.220.140,45.143.220.146,45.143.220.152,45.143.220.18] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 24"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403323; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.143.220.213,45.143.220.231,45.143.220.235,45.143.220.28,45.143.220.48,45.143.222.107,45.143.223.158,45.143.223.21,45.148.10.141,45.148.10.160,45.148.10.64,45.149.206.194,45.150.140.125,45.161.109.35,45.162.158.246,45.163.149.29,45.164.180.78,45.166.154.242,45.167.144.11,45.167.250.19,45.167.95.134,45.169.16.15,45.173.5.38,45.173.5.45,45.176.193.220,45.176.240.44,45.181.170.133,45.182.156.3,45.220.68.91,45.220.84.240,45.220.87.59,45.225.120.21,45.225.236.190,45.227.255.190,45.228.101.185,45.228.12.138,45.229.102.56,45.230.7.14,45.232.5.10,45.233.14.64,45.233.252.25,45.234.77.114,45.235.94.120,45.238.208.3,45.238.244.8,45.240.103.191,45.248.168.86,45.250.239.64,45.251.32.225,45.251.52.6] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 25"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403324; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.252.245.239,45.253.64.112,45.253.64.90,45.254.25.62,45.254.26.171,45.33.50.100,45.33.7.49,45.33.84.29,45.44.10.76,45.55.179.132,45.55.235.30,45.55.32.34,45.55.38.39,45.55.55.17,45.55.65.92,45.55.88.16,45.55.92.115,45.56.125.203,45.56.127.149,45.56.91.118,45.56.91.156,45.58.189.232,45.59.238.186,45.6.39.121,45.61.136.154,45.62.248.24,45.65.215.173,45.70.216.74,45.7.133.45,45.7.209.135,45.73.13.205,45.77.254.120,45.77.254.20,45.78.181.194,45.79.103.8,45.79.106.170,45.79.110.218,45.79.209.188,45.79.213.51,45.79.32.56,45.80.252.49,45.84.221.142,45.88.104.99,45.88.179.138,45.88.43.178,45.9.46.201,45.95.168.131,45.95.168.145,45.95.168.162,45.95.168.245] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 26"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403325; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [45.95.168.96,45.95.168.98,46.100.62.185,46.101.100.227,46.101.132.40,46.101.149.23,46.101.158.75,46.101.171.183,46.101.197.111,46.101.199.196,46.101.201.69,46.101.206.205,46.101.211.160,46.101.223.54,46.101.231.203,46.101.33.198,46.101.6.56,46.101.94.224,46.102.13.112,46.102.171.211,46.102.175.102,46.102.175.105,46.105.112.86,46.105.130.242,46.105.130.246,46.105.130.249,46.105.132.32,46.11.163.174,46.116.99.64,46.13.24.145,46.145.188.106,46.146.242.149,46.146.245.28,46.148.20.25,46.149.32.122,46.150.5.9,46.151.192.226,46.151.40.201,46.151.9.29,46.152.141.237,46.152.53.188,46.161.27.75,46.161.53.51,46.17.121.109,46.171.210.134,46.172.223.236,46.172.70.240,46.173.208.2,46.173.4.36,46.174.191.28] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 27"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403326; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [46.174.191.29,46.174.191.30,46.174.191.31,46.174.191.32,46.180.192.253,46.183.112.72,46.184.61.226,46.185.128.230,46.185.162.140,46.185.78.20,46.199.64.22,46.201.164.152,46.209.117.210,46.209.209.74,46.214.240.164,46.214.60.29,46.219.113.59,46.22.224.50,46.221.12.194,46.224.1.114,46.225.129.84,46.225.242.41,46.233.12.29,46.233.4.150,46.233.58.39,46.24.44.151,46.243.179.136,46.249.91.100,46.25.243.48,46.253.1.246,46.253.95.33,46.254.128.140,46.28.121.134,46.32.250.216,46.32.250.31,46.33.251.77,46.36.132.23,46.36.132.83,46.37.222.227,46.37.24.221,46.38.47.184,46.39.28.44,46.52.188.27,46.55.208.54,46.59.17.98,46.65.103.222,46.70.16.106,46.71.235.110,46.8.173.223,46.99.140.112] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 28"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403327; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [46.99.158.243,46.99.158.80,46.99.251.244,47.138.120.140,47.144.85.62,47.152.60.28,47.180.190.49,47.180.63.200,47.190.36.218,47.196.141.175,47.205.162.158,47.205.35.212,47.206.131.151,47.206.50.173,47.21.134.156,47.240.48.109,47.240.74.5,47.240.81.166,47.241.36.60,47.241.37.106,47.241.68.247,47.241.77.254,47.244.170.197,47.244.21.47,47.244.9.191,47.254.131.234,47.254.148.130,47.254.151.244,47.254.155.71,47.254.184.183,47.34.128.122,47.39.92.151,47.41.49.211,47.44.200.174,47.46.200.83,47.48.235.158,47.52.228.224,47.52.61.206,47.52.64.165,47.52.93.164,47.53.162.96,47.56.181.206,47.56.217.238,47.57.117.233,47.74.224.215,47.74.241.65,47.74.252.116,47.74.255.15,47.75.11.17,47.75.130.193] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 29"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403328; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [47.75.131.71,47.75.140.137,47.75.14.134,47.75.143.123,47.75.148.197,47.75.158.222,47.75.166.1,47.75.190.215,47.75.199.183,47.75.207.187,47.75.47.51,47.75.74.11,47.90.104.221,47.90.19.167,47.90.75.80,47.90.96.169,47.91.146.131,47.91.89.6,47.92.72.19,47.92.85.98,47.94.233.116,47.98.245.155,49.0.76.72,49.128.174.248,49.128.36.34,49.142.102.191,49.142.196.36,49.142.223.68,49.142.82.60,49.143.156.226,49.143.180.12,49.143.185.217,49.143.187.215,49.143.32.6,49.147.124.188,49.159.20.138,49.159.23.18,49.160.7.152,49.164.92.52,49.167.185.78,49.167.5.162,49.175.229.51,49.175.229.54,49.176.209.149,49.194.56.232,49.204.89.226,49.206.26.9,49.207.12.162,49.213.163.179,49.213.163.198] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 30"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403329; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [49.213.171.67,49.213.173.147,49.213.173.225,49.213.178.207,49.213.180.50,49.213.183.50,49.213.184.137,49.213.212.172,49.213.213.152,49.229.29.50,49.231.146.68,49.231.35.39,49.231.66.20,49.232.142.68,49.232.152.49,49.232.158.63,49.232.169.74,49.232.29.58,49.232.55.164,49.232.61.104,49.233.132.148,49.233.160.131,49.233.162.31,49.233.180.152,49.233.180.39,49.233.184.148,49.233.193.237,49.233.204.30,49.233.205.35,49.233.213.121,49.233.215.8,49.233.222.150,49.233.223.202,49.233.82.94,49.233.86.26,49.234.106.231,49.234.178.175,49.234.195.122,49.234.224.170,49.234.225.74,49.234.229.15,49.234.230.108,49.234.31.128,49.234.38.22,49.234.60.13,49.234.82.239,49.235.119.78,49.235.142.123,49.235.156.25,49.235.190.171] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 31"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403330; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [49.235.198.185,49.235.217.9,49.235.238.17,49.235.247.78,49.235.26.143,49.235.37.107,49.235.83.89,49.235.98.52,49.236.192.136,49.236.193.70,49.236.195.150,49.248.106.61,49.248.247.94,49.255.130.118,49.255.15.122,49.255.250.130,49.36.140.63,49.4.68.207,49.50.117.48,49.50.118.67,49.50.85.116,49.51.10.24,49.51.10.34,49.51.11.210,49.51.12.179,49.51.12.221,49.51.12.244,49.51.12.60,49.51.12.61,49.51.13.14,49.51.13.40,49.51.134.254,49.51.150.122,49.51.153.23,49.51.153.85,49.51.155.120,49.51.155.205,49.51.160.107,49.51.160.173,49.51.160.201,49.51.160.240,49.51.160.252,49.51.160.31,49.51.160.47,49.51.160.84,49.51.160.91,49.51.161.114,49.51.161.141,49.51.161.145,49.51.161.183] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 32"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403331; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [49.51.161.186,49.51.161.209,49.51.161.236,49.51.161.252,49.51.161.77,49.51.161.95,49.51.162.151,49.51.162.172,49.51.172.33,49.51.199.227,49.51.241.239,49.51.242.147,49.51.242.196,49.51.242.225,49.51.243.251,49.51.252.116,49.51.252.209,49.51.252.40,49.51.253.158,49.51.253.249,49.51.34.136,49.51.34.227,49.51.49.117,49.51.50.208,49.51.51.127,49.51.51.24,49.51.51.53,49.51.52.89,49.51.8.104,49.51.8.188,49.51.8.195,49.51.8.24,49.51.9.105,49.51.9.134,49.51.9.196,49.51.9.204,49.51.9.216,49.67.13.95,49.7.112.94,49.74.79.60,49.77.59.217,49.79.140.162,49.81.70.119,49.82.71.223,49.84.173.240,49.88.112.109,49.88.150.32,50.115.123.52,50.115.147.42,50.115.172.104] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 33"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403332; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [50.116.103.160,50.116.3.115,50.116.57.83,50.116.62.150,50.195.155.21,50.198.68.115,50.202.44.35,50.203.164.134,50.204.227.109,50.206.55.132,50.207.163.12,50.207.164.73,50.208.29.222,50.225.101.226,50.234.173.102,50.234.222.78,50.237.128.182,50.241.16.1,50.243.254.25,50.246.178.154,50.246.217.197,50.248.246.57,50.249.137.45,50.25.169.205,50.252.114.117,50.252.80.115,50.27.159.137,50.31.138.103,50.57.165.121,50.59.222.38,50.66.172.47,50.7.206.2,50.76.148.93,50.76.95.188,50.77.182.77,50.81.238.153,50.84.147.94,50.84.94.18,50.96.178.2,51.132.128.217,51.136.14.170,51.15.85.14,51.158.173.48,51.158.25.170,51.158.29.191,51.158.29.207,51.158.31.194,51.158.31.243,51.159.59.241,51.161.12.231] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 34"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403333; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [51.161.18.75,51.161.9.127,51.161.9.226,51.178.31.86,51.178.49.219,51.178.53.97,51.178.78.152,51.178.78.153,51.178.78.154,51.219.59.129,51.254.49.100,51.254.49.101,51.254.49.102,51.254.49.103,51.254.49.104,51.254.49.105,51.254.49.106,51.254.49.107,51.254.49.108,51.254.49.109,51.254.49.110,51.254.49.111,51.254.49.96,51.254.49.97,51.254.49.98,51.254.49.99,51.255.109.160,51.255.109.162,51.255.109.163,51.255.109.164,51.255.109.165,51.255.109.167,51.255.109.168,51.255.109.169,51.255.109.170,51.255.109.171,51.255.109.172,51.255.109.173,51.255.109.174,51.255.109.175,51.255.165.122,51.255.170.237,51.255.35.82,51.255.67.124,51.38.140.11,51.38.140.6,51.38.16.203,51.38.244.38,51.52.147.58,51.52.159.78] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 35"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403334; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [51.68.143.219,51.68.32.21,51.75.146.114,51.75.161.33,51.75.203.178,51.75.254.172,51.75.52.127,51.77.163.177,51.77.192.7,51.79.145.232,51.79.51.172,51.79.57.12,51.79.70.223,51.79.73.171,51.81.42.232,51.83.171.10,51.83.171.12,51.83.171.14,51.83.171.4,51.83.44.214,51.83.66.171,51.83.78.82,51.89.105.174,51.89.175.65,51.89.235.112,51.89.67.61,51.91.126.182,51.91.136.174,51.91.190.40,51.91.212.79,51.91.212.80,51.91.212.81,51.91.247.125,51.91.253.21,51.91.68.39,52.119.117.10,52.119.117.32,52.130.65.249,52.130.76.97,52.130.81.35,52.130.86.7,52.160.124.197,52.161.91.185,52.165.223.230,52.178.137.197,52.183.2.117,52.183.43.7,52.229.160.94,52.233.19.172,52.243.38.52] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 36"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403335; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [52.55.125.245,52.55.70.221,52.68.122.160,52.71.95.144,52.73.169.169,54.160.158.30,54.161.69.84,54.162.111.223,54.165.231.250,54.178.127.110,54.196.72.32,54.223.61.142,54.255.128.232,54.36.204.128,54.36.204.135,54.36.49.151,54.37.210.42,54.37.234.70,54.38.240.23,54.38.92.35,54.39.104.201,54.39.215.32,58.10.202.129,58.105.192.99,58.119.4.58,58.119.5.210,58.123.19.126,58.126.223.166,58.126.71.17,58.133.232.240,58.137.160.62,58.137.160.66,58.141.232.44,58.144.208.115,58.147.176.235,58.147.180.108,58.147.180.141,58.147.183.105,58.147.183.114,58.147.183.39,58.147.183.68,58.147.183.95,58.152.125.124,58.152.147.221,58.152.149.100,58.152.232.185,58.152.253.76,58.153.154.129,58.153.182.196,58.153.211.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 37"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403336; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [58.16.215.15,58.163.148.232,58.171.253.198,58.176.208.187,58.177.149.10,58.177.208.2,58.18.102.140,58.18.130.101,58.18.133.165,58.18.250.82,58.18.44.214,58.187.9.166,58.19.180.59,58.19.198.18,58.19.248.233,58.194.176.203,58.20.129.49,58.20.41.53,58.210.140.214,58.210.172.118,58.210.89.180,58.21.192.144,58.211.153.58,58.211.162.58,58.211.240.42,58.211.58.121,58.213.134.6,58.213.194.216,58.213.48.218,58.213.48.219,58.213.91.17,58.213.91.4,58.213.91.9,58.214.255.41,58.215.186.240,58.215.221.82,58.215.235.146,58.215.44.35,58.215.44.43,58.215.44.54,58.215.49.242,58.215.57.137,58.215.61.68,58.215.75.134,58.215.9.154,58.216.101.113,58.216.149.158,58.216.160.214,58.216.164.67,58.216.172.22] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 38"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403337; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [58.216.176.183,58.216.47.50,58.216.51.206,58.216.8.83,58.217.103.57,58.217.157.209,58.217.157.233,58.217.157.46,58.218.185.141,58.218.185.20,58.218.204.20,58.218.213.141,58.218.251.214,58.218.66.85,58.218.67.142,58.219.103.72,58.220.25.2,58.220.33.54,58.220.46.28,58.220.46.37,58.220.46.62,58.220.56.3,58.22.101.120,58.22.218.108,58.221.134.146,58.221.135.150,58.221.173.38,58.221.190.98,58.221.222.194,58.221.247.206,58.221.62.214,58.222.197.186,58.222.233.124,58.222.24.171,58.228.159.253,58.23.211.14,58.236.67.164,58.241.135.9,58.242.68.178,58.246.209.134,58.247.120.118,58.250.27.18,58.252.108.38,58.252.108.40,58.252.108.41,58.254.35.178,58.255.77.17,58.30.80.209,58.32.211.77,58.42.233.74] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 39"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403338; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [58.49.160.175,58.49.230.254,58.49.59.12,58.49.59.43,58.49.94.62,58.51.216.86,58.51.57.85,58.54.82.179,58.56.166.66,58.56.191.30,58.56.200.58,58.56.33.221,58.56.56.174,58.56.66.199,58.57.53.134,58.59.176.111,58.59.176.4,58.59.25.2,58.61.38.185,58.63.245.235,58.64.155.101,58.64.157.162,58.64.160.36,58.64.180.40,58.64.200.114,58.64.200.176,58.64.209.254,58.64.40.72,58.65.153.246,58.65.169.6,58.67.137.189,58.67.221.163,58.7.210.232,58.71.252.152,58.76.162.249,58.82.192.215,58.82.233.119,58.87.68.202,58.87.70.99,58.93.26.10,58.96.222.97,58.97.14.227,58.99.0.202,59.0.22.131,59.0.75.71,59.0.85.168,59.1.101.81,59.108.32.55,59.108.47.88,59.110.217.182] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 40"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403339; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.110.240.245,59.11.107.39,59.11.248.116,59.11.26.52,59.11.82.111,59.115.127.211,59.115.141.158,59.120.103.137,59.120.55.33,59.120.74.96,59.124.115.208,59.124.11.71,59.124.229.26,59.124.254.14,59.125.139.32,59.125.188.151,59.125.189.53,59.125.218.155,59.125.218.249,59.125.226.69,59.125.4.119,59.125.55.151,59.125.89.91,59.126.102.222,59.126.111.191,59.126.111.253,59.126.124.101,59.126.14.131,59.126.147.69,59.126.15.19,59.126.159.144,59.126.160.208,59.126.166.60,59.126.169.60,59.126.171.21,59.126.20.169,59.126.208.127,59.126.214.100,59.126.227.185,59.126.230.135,59.126.242.29,59.126.3.195,59.126.32.32,59.126.34.89,59.126.36.14,59.126.4.20,59.126.55.105,59.126.69.205,59.126.7.178,59.126.81.179] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 41"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403340; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.126.87.123,59.126.92.112,59.127.101.240,59.127.10.133,59.127.113.141,59.127.131.183,59.127.13.161,59.127.147.110,59.127.166.81,59.127.181.133,59.127.191.68,59.127.197.36,59.127.202.201,59.127.203.50,59.127.236.228,59.127.240.138,59.127.251.94,59.127.252.150,59.127.27.186,59.127.4.171,59.127.41.84,59.127.42.161,59.127.49.26,59.127.51.67,59.127.53.167,59.127.63.180,59.127.64.75,59.127.69.111,59.127.73.150,59.127.9.232,59.127.97.41,59.145.211.194,59.148.21.4,59.148.2.18,59.149.150.143,59.15.16.138,59.152.161.194,59.152.251.30,59.16.203.219,59.163.248.100,59.165.162.70,59.17.123.104,59.173.12.166,59.173.238.118,59.173.46.163,59.174.79.73,59.175.228.60,59.179.31.46,59.181.142.186,59.186.44.134] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 42"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403341; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.188.196.226,59.188.30.20,59.188.72.137,59.188.73.200,59.190.91.121,59.19.195.226,59.22.165.54,59.22.96.35,59.23.93.237,59.24.104.209,59.24.115.124,59.24.189.107,59.26.190.23,59.26.212.234,59.26.237.138,59.27.118.163,59.27.12.43,59.27.16.224,59.30.208.105,59.30.39.51,59.36.143.3,59.37.8.105,59.38.100.118,59.38.35.102,59.4.199.175,59.41.184.206,59.42.89.253,59.44.149.52,59.44.149.53,59.44.37.156,59.46.0.36,59.46.43.58,59.46.53.210,59.47.122.105,59.49.104.232,59.50.85.195,59.5.196.9,59.55.128.170,59.55.5.133,59.56.226.180,59.56.65.125,59.56.65.13,59.57.183.237,59.57.248.34,59.58.206.226,59.60.84.37,59.6.147.79,59.61.204.158,59.63.163.165,59.63.163.49] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 43"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403342; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [59.63.169.10,59.7.155.141,59.7.22.130,59.76.80.213,59.8.137.44,59.9.119.87,60.12.104.157,60.12.155.220,60.12.33.9,60.12.94.186,60.13.146.20,60.13.194.158,60.13.194.71,60.13.218.82,60.13.240.104,60.15.251.149,60.15.251.150,60.15.251.151,60.15.251.152,60.15.251.153,60.15.251.154,60.15.251.155,60.15.34.250,60.164.172.206,60.164.190.154,60.165.242.196,60.165.53.185,60.167.71.10,60.169.66.243,60.170.101.25,60.170.10.219,60.170.119.252,60.170.166.189,60.170.166.72,60.170.180.96,60.170.189.102,60.170.203.82,60.170.218.225,60.170.255.227,60.17.248.233,60.172.5.109,60.172.8.10,60.173.178.149,60.173.179.69,60.173.252.157,60.173.255.176,60.174.186.11,60.174.21.13,60.174.21.251,60.174.2.55] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 44"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403343; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [60.174.55.78,60.175.124.27,60.175.124.8,60.18.128.4,60.18.184.72,60.184.176.155,60.186.119.2,60.188.102.160,60.188.173.8,60.189.40.177,60.190.143.82,60.190.239.58,60.190.249.119,60.190.249.121,60.190.96.235,60.191.0.118,60.191.119.99,60.191.127.122,60.191.52.254,60.199.223.17,60.2.240.94,60.2.245.166,60.2.26.206,60.205.200.235,60.208.127.75,60.208.128.251,60.209.36.26,60.210.103.211,60.210.211.42,60.210.7.222,60.213.17.106,60.214.153.118,60.215.165.97,60.216.75.24,60.216.86.130,60.216.99.222,60.217.68.88,60.218.191.175,60.218.191.177,60.218.191.182,60.218.191.224,60.220.54.14,60.22.74.221,60.221.229.142,60.221.244.100,60.223.239.164,60.224.2.170,60.246.136.137,60.246.184.131,60.246.192.13] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 45"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403344; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [60.246.234.0,60.246.75.194,60.248.122.172,60.248.122.97,60.248.127.85,60.248.130.106,60.248.136.209,60.248.139.169,60.248.157.116,60.248.49.70,60.249.117.226,60.249.145.25,60.249.253.179,60.249.80.221,60.249.84.190,60.249.90.226,60.250.235.148,60.251.111.30,60.251.137.215,60.251.140.1,60.251.151.168,60.251.165.18,60.251.199.192,60.251.203.79,60.251.55.15,60.251.80.76,60.251.80.85,60.255.139.145,60.255.41.150,60.28.201.185,60.28.24.184,60.30.147.118,60.31.180.229,60.31.193.20,60.48.210.204,60.6.210.131,60.7.148.126,60.7.75.85,60.8.180.8,60.8.197.210,60.8.216.98,60.9.234.17,61.10.28.30,61.102.164.30,61.102.169.89,61.109.243.91,61.125.156.67,61.129.180.178,61.130.110.198,61.131.20.133] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 46"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403345; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.131.207.66,61.131.228.76,61.132.42.50,61.132.87.130,61.133.118.6,61.133.194.58,61.133.238.130,61.134.23.202,61.135.215.237,61.136.101.103,61.136.101.76,61.136.143.165,61.136.144.163,61.138.54.99,61.139.104.194,61.139.105.98,61.142.119.19,61.142.29.2,61.142.75.66,61.143.205.222,61.143.205.229,61.143.43.3,61.143.44.54,61.143.53.234,61.144.244.75,61.146.115.89,61.146.199.186,61.147.103.136,61.147.103.181,61.147.111.169,61.147.115.149,61.147.96.169,61.148.205.166,61.148.222.198,61.148.238.4,61.149.142.110,61.150.76.201,61.151.247.189,61.152.90.81,61.153.110.83,61.157.138.117,61.157.86.148,61.157.91.111,61.158.167.184,61.160.196.28,61.160.200.58,61.160.245.66,61.160.251.29,61.161.155.100,61.161.198.99] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 47"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403346; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.163.165.101,61.163.192.28,61.163.200.249,61.163.216.136,61.163.89.27,61.164.115.242,61.164.37.178,61.164.57.108,61.164.96.126,61.164.96.82,61.164.96.98,61.164.98.226,61.165.35.62,61.167.22.144,61.170.132.67,61.174.49.17,61.174.50.171,61.174.50.50,61.177.142.200,61.177.72.251,61.178.103.131,61.178.103.133,61.178.103.137,61.178.103.146,61.178.103.148,61.178.108.175,61.178.19.67,61.178.249.22,61.178.249.25,61.178.29.191,61.178.29.50,61.178.32.88,61.178.63.247,61.178.66.14,61.178.81.109,61.181.255.77,61.183.52.106,61.183.52.133,61.183.52.144,61.183.52.146,61.183.52.45,61.183.52.5,61.183.9.45,61.184.234.23,61.188.103.193,61.189.42.58,61.190.124.188,61.190.124.208,61.190.18.46,61.190.97.94] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 48"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403347; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.19.108.118,61.19.30.156,61.19.64.9,61.191.101.186,61.191.98.59,61.216.104.177,61.216.109.80,61.216.145.231,61.216.164.89,61.216.183.94,61.216.2.79,61.216.35.96,61.216.40.209,61.216.51.177,61.216.91.27,61.216.92.89,61.218.122.209,61.218.134.110,61.218.212.14,61.218.250.137,61.218.44.95,61.219.11.153,61.219.170.130,61.219.178.89,61.219.81.58,61.219.98.71,61.220.101.99,61.220.128.67,61.220.150.137,61.220.182.91,61.220.196.1,61.220.204.216,61.220.216.179,61.220.251.176,61.221.167.145,61.221.180.244,61.222.127.115,61.222.241.229,61.223.165.19,61.223.28.212,61.231.243.19,61.233.14.171,61.243.130.64,61.243.39.70,61.244.125.236,61.244.174.58,61.244.206.38,61.244.247.105,61.247.67.122,61.252.53.180] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 49"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403348; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [61.255.61.136,61.48.20.118,61.50.101.202,61.50.110.114,61.50.117.74,61.50.133.43,61.50.195.4,61.53.230.134,61.53.64.245,61.53.69.32,61.54.2.103,61.54.231.129,61.55.29.223,61.6.200.26,61.61.88.135,61.65.132.213,61.68.17.70,61.68.191.80,61.68.221.158,61.68.25.46,61.7.235.85,61.7.253.197,61.72.242.227,61.74.53.173,61.74.53.221,61.76.221.147,61.76.59.114,61.77.134.65,61.77.34.77,61.77.79.160,61.78.96.158,61.8.69.98,61.82.40.103,61.83.86.105,61.83.97.180,61.84.138.57,61.84.247.221,61.85.12.175,61.85.155.134,61.90.140.210,61.90.160.216,61.91.53.2,61.99.132.215,62.0.134.162,62.103.31.228,62.108.37.26,62.113.117.93,62.114.126.172,62.141.113.30,62.141.129.158] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 50"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403349; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [62.148.150.183,62.150.126.58,62.150.192.1,62.169.239.187,62.171.132.67,62.171.152.36,62.171.167.199,62.171.176.180,62.171.177.76,62.172.234.115,62.172.234.21,62.173.140.21,62.174.134.219,62.176.123.148,62.192.41.82,62.210.105.231,62.210.116.151,62.210.143.6,62.210.70.74,62.210.76.202,62.212.104.138,62.212.230.38,62.213.82.18,62.215.6.11,62.219.193.224,62.219.226.245,62.220.210.145,62.224.217.49,62.232.133.26,62.234.110.221,62.234.126.21,62.234.127.150,62.234.139.150,62.234.140.15,62.234.6.145,62.234.62.219,62.234.89.176,62.234.98.144,62.235.28.18,62.240.112.70,62.244.140.37,62.255.13.246,62.28.0.172,62.28.122.194,62.28.163.82,62.28.181.122,62.28.187.44,62.28.192.210,62.28.192.86,62.28.203.66] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 51"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403350; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [62.28.211.26,62.28.215.142,62.28.215.30,62.28.227.30,62.28.23.83,62.28.246.118,62.28.24.98,62.28.28.242,62.28.29.150,62.28.30.206,62.28.58.118,62.28.88.118,62.28.9.238,62.33.199.134,62.4.14.123,62.4.48.234,62.45.209.242,62.48.218.138,62.68.144.60,62.69.130.155,62.77.173.242,62.90.162.254,62.90.192.239,62.94.211.10,62.97.173.73,62.98.245.87,62.98.71.215,62.99.119.151,62.99.55.78,63.134.149.24,63.143.88.210,63.168.21.195,63.225.161.101,63.237.48.34,63.78.116.109,64.121.52.239,64.182.119.2,64.184.197.239,64.19.86.182,64.225.103.7,64.225.104.142,64.225.106.89,64.225.107.165,64.225.111.247,64.225.112.28,64.225.115.188,64.225.116.46,64.225.118.25,64.225.118.99,64.225.123.93] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 52"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403351; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [64.225.127.44,64.225.14.108,64.225.2.140,64.225.22.43,64.225.25.10,64.225.3.129,64.225.3.172,64.225.42.104,64.225.45.177,64.225.70.13,64.225.78.156,64.225.78.39,64.225.8.170,64.225.98.118,64.227.10.240,64.227.116.238,64.227.120.56,64.227.120.58,64.227.120.63,64.227.12.177,64.227.12.99,64.227.17.251,64.227.21.199,64.227.21.239,64.227.22.194,64.227.23.146,64.227.23.233,64.227.24.112,64.227.24.206,64.227.25.158,64.227.25.174,64.227.25.180,64.227.29.237,64.227.35.138,64.227.35.162,64.227.36.221,64.227.4.164,64.227.45.97,64.227.54.28,64.227.56.27,64.227.6.231,64.227.70.78,64.227.71.59,64.227.72.66,64.227.73.193,64.227.74.144,64.227.9.196,64.32.21.254,64.34.49.230,64.37.51.69] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 53"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403352; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [64.53.101.72,64.64.104.10,64.79.89.138,64.91.124.170,64.91.249.207,64.91.64.222,64.91.76.97,65.110.110.218,65.126.27.58,65.132.139.90,65.19.154.162,65.19.174.198,65.19.174.248,65.223.59.43,65.23.157.74,65.24.235.86,65.39.201.178,65.49.20.100,65.49.20.102,65.49.20.103,65.49.20.104,65.49.20.105,65.49.20.106,65.49.20.107,65.49.20.108,65.49.20.109,65.49.20.112,65.49.20.113,65.49.20.117,65.49.20.118,65.49.20.119,65.49.20.121,65.49.20.122,65.49.20.123,65.49.20.124,65.49.20.125,65.49.20.126,65.49.20.72,65.49.20.76,65.49.20.77,65.49.20.78,65.49.20.80,65.49.20.83,65.49.20.84,65.49.20.85,65.49.20.87,65.49.20.88,65.49.20.91,65.49.20.94,65.49.20.97] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 54"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403353; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [65.49.20.99,65.50.147.71,65.73.156.118,65.75.101.49,65.91.52.175,65.99.166.103,66.108.21.155,66.108.223.228,66.114.118.39,66.117.12.196,66.130.177.164,66.146.180.130,66.153.195.73,66.168.122.180,66.175.156.188,66.181.166.128,66.189.219.80,66.196.62.167,66.205.179.226,66.220.12.90,66.232.63.37,66.235.84.52,66.240.192.138,66.240.205.34,66.240.219.146,66.240.236.119,66.31.253.240,66.34.192.9,66.42.166.10,66.42.48.10,66.42.55.119,66.42.60.60,66.64.44.226,66.70.250.106,66.76.46.118,66.83.166.14,66.97.181.216,67.140.143.123,67.149.11.83,67.159.148.230,67.166.23.54,67.168.252.22,67.183.251.230,67.198.189.221,67.198.189.223,67.198.189.224,67.198.189.225,67.198.189.228,67.198.189.244,67.198.189.52] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 55"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403354; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [67.198.189.53,67.198.189.56,67.198.189.57,67.198.189.69,67.198.232.59,67.200.151.42,67.200.223.178,67.200.232.243,67.205.144.244,67.205.154.203,67.205.160.31,67.205.166.143,67.205.166.88,67.205.170.239,67.205.173.227,67.206.200.122,67.207.88.180,67.213.235.14,67.214.201.51,67.215.244.230,67.225.163.49,67.227.152.142,67.229.135.18,67.229.175.226,67.231.21.21,67.243.144.153,67.244.21.162,67.253.103.144,67.53.2.150,67.54.156.88,67.55.9.0,67.58.24.46,67.78.173.90,67.78.4.26,67.78.68.198,67.79.23.170,67.80.150.104,67.84.196.148,67.9.122.230,68.107.172.103,68.110.199.79,68.11.156.29,68.132.136.198,68.132.184.223,68.144.91.97,68.150.109.112,68.161.231.230,68.171.157.231,68.173.243.86,68.183.107.155] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 56"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403355; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [68.183.12.127,68.183.146.178,68.183.153.161,68.183.157.244,68.183.157.29,68.183.16.217,68.183.180.179,68.183.182.120,68.183.183.118,68.183.183.27,68.183.186.25,68.183.187.13,68.183.187.234,68.183.193.132,68.183.215.157,68.183.229.218,68.183.28.186,68.183.31.75,68.183.34.236,68.183.37.169,68.183.55.223,68.183.56.212,68.183.78.87,68.183.80.250,68.183.85.116,68.183.86.198,68.183.92.100,68.183.92.118,68.183.92.251,68.183.95.11,68.183.95.39,68.194.144.147,68.198.214.252,68.255.154.241,68.35.159.199,68.44.108.200,68.51.19.20,68.67.210.83,68.70.49.253,68.96.25.174,69.118.29.81,69.133.145.244,69.142.158.70,69.146.134.2,69.162.74.166,69.164.210.109,69.165.173.49,69.165.224.111,69.165.230.239,69.171.192.58] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 57"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403356; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [69.175.97.170,69.175.97.171,69.175.97.172,69.175.97.173,69.175.97.174,69.193.158.70,69.193.2.251,69.193.59.111,69.197.191.186,69.248.57.179,69.28.34.18,69.39.57.78,69.41.128.33,69.42.66.94,69.42.81.68,69.42.89.216,69.47.208.113,69.60.23.149,69.65.79.99,69.70.96.242,69.75.64.34,69.76.196.64,69.80.31.143,69.84.97.248,69.90.184.206,69.90.184.209,69.94.155.176,70.113.157.223,70.118.38.142,70.124.223.136,70.169.134.185,70.182.172.19,70.25.69.174,70.33.206.130,70.37.61.136,70.44.225.34,70.52.189.82,70.60.38.12,70.74.196.3,70.78.110.101,70.81.4.114,70.89.57.206,71.104.27.123,71.12.27.38,71.127.40.137,71.14.255.251,71.14.87.212,71.167.41.46,71.183.79.85,71.189.93.102] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 58"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403357; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [71.221.32.243,71.225.166.165,71.233.207.169,71.237.97.77,71.251.119.91,71.251.92.8,71.254.8.90,71.29.91.228,71.41.76.58,71.41.76.62,71.42.172.44,71.42.228.182,71.47.104.200,71.56.46.143,71.6.135.131,71.6.146.130,71.6.146.185,71.6.146.186,71.6.147.254,71.6.158.166,71.6.165.200,71.6.167.142,71.6.199.23,71.6.231.186,71.6.231.8,71.6.231.80,71.6.231.81,71.6.231.83,71.6.231.86,71.6.231.87,71.6.232.4,71.6.232.5,71.6.232.6,71.6.232.8,71.66.4.243,71.74.248.144,71.78.133.84,71.78.192.34,71.84.72.147,71.90.14.60,71.95.6.42,72.130.215.174,72.138.45.190,72.138.83.242,72.17.22.30,72.17.50.206,72.17.60.150,72.181.243.237,72.182.166.90,72.186.211.177] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 59"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403358; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [72.187.208.210,72.187.238.18,72.188.165.48,72.200.244.203,72.20.91.172,72.213.21.79,72.216.202.55,72.224.252.150,72.249.226.29,72.249.56.8,72.252.114.154,72.252.196.30,72.252.247.85,72.253.108.147,72.255.111.147,72.27.95.89,72.34.42.196,72.38.192.163,72.4.34.117,72.43.195.114,72.43.19.94,72.53.106.100,72.53.233.6,72.55.235.235,72.55.235.249,72.76.147.193,72.80.19.63,72.80.30.200,72.89.131.110,72.89.153.61,72.95.129.172,73.107.103.239,73.117.30.152,73.124.60.38,73.125.172.169,73.129.186.234,73.139.52.253,73.144.145.41,73.175.132.254,73.177.101.8,73.18.136.31,73.185.241.75,73.194.116.117,73.204.200.55,73.223.12.30,73.232.33.168,73.245.127.219,73.251.244.10,73.29.72.229,73.32.102.153] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 60"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403359; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [73.51.74.139,73.70.242.70,73.77.91.35,73.85.110.241,73.91.22.9,73.92.227.135,74.101.171.253,74.102.39.43,74.114.72.98,74.120.200.170,74.130.35.52,74.15.117.194,74.15.22.215,74.194.221.83,74.204.141.196,74.207.227.48,74.213.112.113,74.215.200.125,74.221.64.4,74.50.155.232,74.62.91.28,74.63.228.198,74.64.36.123,74.77.210.174,74.85.156.34,74.96.219.2,75.1.97.126,75.109.218.53,75.111.166.126,75.113.131.233,75.113.223.38,75.145.126.193,75.148.156.244,75.150.9.174,75.155.220.20,75.160.214.216,75.172.8.126,75.74.38.207,76.109.197.156,76.164.153.25,76.170.55.195,76.171.104.248,76.173.238.69,76.174.197.9,76.179.248.164,76.187.66.245,76.190.103.182,76.190.16.98,76.240.125.9,76.66.166.35] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 61"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403360; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [76.76.189.82,77.106.106.191,77.107.41.121,77.107.41.186,77.107.41.216,77.108.52.128,77.121.174.100,77.122.249.132,77.123.134.244,77.138.251.193,77.139.197.124,77.220.133.164,77.222.134.242,77.228.70.225,77.232.100.210,77.232.170.186,77.237.87.208,77.239.225.166,77.239.59.192,77.239.65.206,77.240.151.154,77.240.89.92,77.242.20.190,77.243.181.54,77.246.101.4,77.247.108.119,77.247.108.77,77.247.109.101,77.247.109.241,77.247.109.5,77.247.109.68,77.247.109.72,77.247.109.73,77.247.110.25,77.247.110.58,77.254.209.158,77.26.155.10,77.31.30.66,77.36.18.226,77.38.243.75,77.41.123.213,77.45.13.85,77.46.133.145,77.46.179.227,77.47.192.82,77.48.24.62,77.51.177.114,77.53.125.3,77.54.105.77,77.58.98.121] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 62"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403361; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [77.70.80.234,77.71.232.31,77.75.129.136,77.79.132.10,77.79.134.90,77.81.191.142,77.81.54.130,77.81.67.194,77.85.165.204,77.89.239.218,77.95.0.50,77.95.161.35,78.105.68.110,78.108.177.50,78.108.177.51,78.108.177.52,78.108.177.53,78.108.177.54,78.109.129.108,78.120.56.104,78.128.113.42,78.128.41.7,78.131.11.97,78.132.141.106,78.134.12.21,78.139.235.56,78.139.2.89,78.142.228.9,78.152.161.133,78.165.78.210,78.172.61.45,78.175.71.19,78.185.198.164,78.186.156.212,78.186.200.80,78.186.214.135,78.186.219.202,78.187.11.158,78.187.203.177,78.187.235.44,78.187.26.201,78.187.56.7,78.187.5.99,78.188.141.214,78.188.151.201,78.188.168.199,78.188.172.184,78.188.193.106,78.188.197.69,78.188.21.128] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 63"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403362; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [78.188.218.80,78.188.228.144,78.188.238.108,78.188.37.3,78.188.42.22,78.188.59.87,78.188.74.50,78.188.86.210,78.188.86.98,78.189.154.68,78.192.61.77,78.194.1.42,78.21.253.107,78.217.160.38,78.22.61.76,78.24.218.27,78.25.143.8,78.29.32.105,78.29.9.120,78.30.46.42,78.33.49.186,78.37.87.19,78.38.98.152,78.41.93.6,78.5.170.222,78.56.118.81,78.56.74.42,78.58.115.148,78.61.219.49,78.66.209.22,78.67.120.206,78.67.120.64,78.68.121.208,78.70.54.137,78.70.61.235,78.71.234.246,78.72.233.107,78.72.255.180,78.72.255.234,78.84.219.13,78.84.25.2,78.85.36.59,78.85.69.118,78.87.105.254,78.90.130.13,78.90.200.215,78.96.0.85,78.96.17.76,78.96.32.107,79.0.173.121] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 64"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403363; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [79.0.181.62,79.0.214.80,79.10.108.242,79.10.194.249,79.10.209.109,79.10.211.202,79.10.35.178,79.1.180.90,79.1.194.79,79.107.164.159,79.109.224.221,79.11.212.202,79.11.57.169,79.111.242.3,79.113.214.168,79.115.117.101,79.116.147.251,79.116.243.165,79.117.71.68,79.118.148.62,79.118.78.244,79.12.182.192,79.121.107.210,79.121.109.66,79.121.92.108,79.124.62.51,79.124.62.55,79.124.62.66,79.124.62.82,79.124.62.86,79.124.8.95,79.129.138.102,79.129.14.107,79.129.52.162,79.130.63.54,79.131.80.183,79.133.151.229,79.133.201.82,79.134.206.30,79.135.40.228,79.135.72.36,79.135.73.132,79.136.83.52,79.138.8.251,79.138.9.68,79.140.20.207,79.143.32.195,79.152.165.196,79.173.183.30,79.173.253.197] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 65"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403364; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [79.175.152.160,79.175.176.229,79.175.36.37,79.187.16.142,79.189.124.138,79.19.122.166,79.23.205.219,79.237.151.235,79.25.209.75,79.26.149.125,79.36.209.206,79.40.223.104,79.44.247.190,79.46.64.104,79.52.104.158,79.53.33.160,79.53.89.49,79.56.167.101,79.56.57.125,79.58.204.202,79.58.215.225,79.59.152.40,79.6.204.141,79.6.210.116,79.70.161.55,79.7.146.245,79.7.179.104,79.72.70.205,79.78.46.116,79.79.39.112,79.79.44.100,79.8.100.126,79.8.243.10,79.8.66.59,80.104.17.57,80.106.182.194,80.11.35.146,80.111.60.4,80.112.133.223,80.116.106.158,80.120.151.142,80.150.175.147,80.15.208.223,80.15.21.65,80.151.81.13,80.156.215.4,80.178.121.35,80.178.214.52,80.180.128.48,80.180.173.238] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 66"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403365; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [80.180.179.121,80.181.213.59,80.183.124.229,80.184.84.135,80.184.84.163,80.194.234.223,80.20.231.251,80.211.128.151,80.211.131.110,80.211.136.164,80.211.139.133,80.211.156.86,80.211.171.78,80.211.230.27,80.211.241.152,80.211.24.117,80.211.244.16,80.211.34.241,80.211.35.87,80.211.37.15,80.211.67.90,80.211.79.220,80.211.84.100,80.211.89.9,80.212.149.174,80.216.239.79,80.217.240.176,80.22.249.253,80.227.193.178,80.229.150.236,80.229.37.136,80.232.171.241,80.232.185.174,80.242.65.194,80.246.2.152,80.248.10.237,80.248.10.251,80.252.143.210,80.253.20.94,80.254.120.31,80.28.229.86,80.38.139.178,80.55.175.172,80.65.29.139,80.67.223.41,80.70.190.113,80.72.82.82,80.73.91.130,80.76.42.125,80.77.112.148] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 67"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403366; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [80.78.69.194,80.82.46.191,80.82.64.110,80.82.64.127,80.82.64.219,80.82.64.73,80.82.65.62,80.82.65.74,80.82.70.118,80.82.70.239,80.82.77.132,80.82.77.139,80.82.77.189,80.82.77.212,80.82.77.227,80.82.77.232,80.82.77.234,80.82.77.235,80.82.77.245,80.82.77.33,80.82.77.85,80.82.77.86,80.82.78.100,80.82.78.104,80.82.78.192,80.82.78.20,80.82.78.211,80.87.77.100,80.92.100.202,80.93.210.202,80.98.200.246,81.105.223.91,81.107.255.176,81.107.85.15,81.12.94.122,81.12.94.126,81.128.164.27,81.128.191.59,81.134.252.250,81.144.129.98,81.145.192.123,81.145.52.54,81.148.211.2,81.156.104.0,81.159.244.34,81.16.117.56,81.168.131.214,81.17.92.4,81.177.181.222,81.18.59.251] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 68"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403367; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [81.182.242.133,81.182.246.50,81.190.16.18,81.192.52.89,81.192.53.131,81.196.75.11,81.196.95.201,81.205.223.85,81.209.62.121,81.209.69.175,81.213.150.156,81.213.154.253,81.213.199.64,81.213.59.71,81.214.129.221,81.214.143.47,81.218.199.121,81.218.213.101,81.22.48.96,81.224.30.133,81.224.30.169,81.225.115.46,81.227.222.184,81.228.128.247,81.230.173.135,81.232.187.223,81.233.111.151,81.233.23.246,81.234.178.123,81.236.252.32,81.241.207.133,81.241.238.49,81.247.212.104,81.248.4.6,81.250.151.128,81.25.58.50,81.255.98.151,81.28.41.5,81.30.182.145,81.31.238.43,81.40.101.10,81.4.112.221,81.4.245.44,81.47.170.93,81.5.142.220,81.7.137.124,81.82.247.71,81.83.235.170,81.88.116.237,81.88.221.227] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 69"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403368; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [81.93.101.46,81.94.18.207,81.94.243.61,82.1.164.58,82.102.12.136,82.102.158.84,82.102.173.75,82.103.95.42,82.103.95.46,82.114.67.122,82.117.235.56,82.118.231.39,82.119.93.12,82.127.237.205,82.135.63.190,82.137.26.250,82.142.104.141,82.154.208.42,82.154.209.76,82.154.212.19,82.155.111.104,82.163.234.174,82.165.195.173,82.166.147.24,82.166.239.179,82.194.17.249,82.194.18.11,82.196.105.39,82.198.187.191,82.200.142.22,82.200.251.66,82.200.97.206,82.202.197.233,82.202.70.7,82.208.151.125,82.209.198.252,82.209.249.65,82.212.103.10,82.213.250.184,82.214.152.19,82.221.105.6,82.221.105.7,82.223.115.97,82.235.152.201,82.251.101.135,82.253.98.115,82.255.154.111,82.255.38.238,82.40.248.82,82.45.17.179] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 70"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403369; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [82.50.145.178,82.54.129.74,82.57.125.243,82.62.118.102,82.62.16.201,82.62.206.199,82.62.246.70,82.62.39.72,82.62.45.48,82.64.216.10,82.66.193.96,82.76.110.144,82.76.134.53,82.76.16.50,82.76.44.175,82.77.172.31,82.77.63.9,82.78.246.241,82.78.33.11,82.78.88.114,82.79.150.228,82.79.220.25,82.79.227.215,82.80.54.90,82.81.134.138,82.96.32.125,82.96.41.180,82.97.201.55,82.99.193.52,83.0.189.110,83.0.235.46,83.101.139.170,83.102.172.104,83.103.237.117,83.110.104.31,83.110.147.165,83.110.239.253,83.110.5.148,83.110.55.167,83.110.87.206,83.111.205.146,83.12.148.202,83.12.179.10,83.128.59.45,83.136.114.154,83.136.238.93,83.14.224.41,83.143.148.197,83.143.246.30,83.153.149.104] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 71"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403370; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [83.166.215.168,83.167.1.169,83.169.197.13,83.169.220.167,83.17.199.157,83.19.149.186,83.198.158.135,83.208.46.43,83.209.249.33,83.209.40.236,83.209.4.72,83.209.60.116,83.220.172.181,83.221.222.154,83.222.171.108,83.222.189.170,83.226.4.152,83.227.94.231,83.228.104.207,83.228.23.146,83.228.34.217,83.233.162.185,83.233.167.87,83.233.68.162,83.235.176.144,83.239.149.47,83.239.167.62,83.239.186.54,83.239.46.124,83.240.141.118,83.240.181.170,83.240.182.154,83.240.182.242,83.240.182.94,83.240.187.170,83.240.189.18,83.240.191.254,83.240.209.242,83.240.213.214,83.240.236.118,83.240.241.46,83.240.242.246,83.240.242.250,83.240.243.66,83.246.233.22,83.250.212.218,83.250.212.227,83.253.119.99,83.253.40.16,83.254.101.183] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 72"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403371; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [83.254.102.243,83.3.151.42,83.3.255.6,83.35.232.241,83.36.185.75,83.39.126.104,83.53.97.181,83.66.123.87,83.66.172.90,83.68.225.108,83.68.232.158,83.68.237.104,83.69.222.102,83.86.11.248,83.96.12.44,83.97.20.133,83.97.20.140,83.97.20.164,83.97.20.186,83.97.20.203,83.97.20.206,83.97.20.224,83.97.20.226,83.97.20.232,83.97.20.25,83.97.20.31,83.97.20.34,83.98.249.26,84.108.40.17,84.213.176.207,84.215.250.24,84.217.92.220,84.219.195.128,84.219.210.249,84.22.144.52,84.22.35.210,84.228.100.125,84.228.102.198,84.232.227.181,84.234.255.222,84.236.168.158,84.237.104.15,84.237.164.20,84.238.101.103,84.241.56.76,84.242.118.84,84.242.132.114,84.243.217.202,84.243.226.186,84.244.47.42] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 73"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403372; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [84.255.202.188,84.33.124.223,84.38.184.53,84.40.122.204,84.43.107.189,84.46.146.161,84.47.161.29,84.51.14.186,84.51.60.137,84.53.237.140,84.54.185.34,84.9.21.185,84.99.36.50,85.101.72.20,85.104.121.76,85.105.102.69,85.105.109.2,85.105.153.136,85.105.154.118,85.105.155.95,85.105.165.165,85.105.170.120,85.105.217.130,85.105.218.93,85.105.231.221,85.105.247.98,85.105.36.139,85.105.39.105,85.105.44.231,85.105.69.143,85.108.221.118,85.11.48.222,85.116.124.122,85.117.32.86,85.12.231.73,85.12.242.154,85.122.92.177,85.13.101.172,85.132.106.148,85.132.79.170,85.133.190.156,85.14.10.115,85.143.106.73,85.149.18.254,85.149.51.154,85.159.27.40,85.159.66.131,85.16.100.54,85.16.133.247,85.172.11.101] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 74"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403373; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [85.172.79.25,85.175.100.254,85.185.200.161,85.187.124.112,85.187.209.227,85.187.218.116,85.187.220.39,85.187.82.44,85.191.109.196,85.192.59.10,85.196.181.250,85.198.184.205,85.202.176.146,85.207.44.11,85.208.213.24,85.208.220.25,85.209.0.100,85.209.0.134,85.209.0.57,85.209.0.69,85.214.104.50,85.217.204.38,85.224.196.195,85.224.199.40,85.225.27.72,85.226.179.186,85.227.85.44,85.229.171.73,85.230.173.199,85.230.175.14,85.234.6.140,85.246.37.124,85.249.97.230,85.255.203.42,85.26.227.154,85.28.108.39,85.30.232.135,85.31.113.143,85.31.33.6,85.62.12.250,85.66.47.175,85.70.179.251,85.72.38.209,85.88.162.44,85.89.183.27,85.90.208.125,85.93.20.248,85.95.153.59,85.97.184.130,85.97.187.12] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 75"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403374; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [85.99.175.144,85.99.247.245,85.99.97.62,85.99.98.182,86.1.206.76,86.102.131.30,86.102.175.6,86.105.120.221,86.105.53.132,86.108.23.2,86.120.27.226,86.120.40.195,86.121.227.160,86.121.33.1,86.122.123.48,86.122.144.77,86.122.55.214,86.122.58.49,86.122.68.179,86.123.179.13,86.123.182.87,86.123.211.133,86.124.143.85,86.124.63.66,86.124.74.104,86.124.92.241,86.125.37.119,86.125.38.101,86.126.153.135,86.126.153.141,86.127.101.48,86.127.253.84,86.127.79.80,86.138.217.137,86.140.78.120,86.170.111.175,86.193.152.3,86.233.85.32,86.238.210.123,86.34.38.177,86.34.72.210,86.35.202.193,86.35.214.87,86.35.35.99,86.38.171.149,86.45.145.20,86.57.131.182,86.57.170.160,86.57.173.146,86.57.235.240] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 76"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403375; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [86.57.247.26,86.57.93.97,86.60.114.16,86.61.77.254,86.62.5.233,86.8.113.179,86.90.55.201,86.91.191.103,86.92.131.190,86.93.142.223,86.98.158.141,86.98.36.46,86.98.59.115,86.98.82.8,87.103.170.105,87.107.124.36,87.110.185.78,87.110.236.155,87.118.56.50,87.120.160.114,87.120.213.44,87.121.14.235,87.127.224.198,87.13.117.29,87.13.227.228,87.18.209.135,87.19.104.142,87.200.7.118,87.201.130.190,87.203.106.22,87.214.104.138,87.214.234.168,87.226.165.143,87.227.210.202,87.236.212.197,87.236.27.177,87.237.234.149,87.238.237.170,87.241.105.71,87.241.106.15,87.241.135.252,87.241.138.12,87.241.138.139,87.241.138.66,87.241.160.108,87.241.166.227,87.241.236.130,87.241.93.91,87.242.224.202,87.242.249.114] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 77"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403376; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [87.244.235.27,87.245.170.34,87.246.33.219,87.247.97.189,87.249.156.61,87.251.245.80,87.251.247.238,87.251.74.10,87.251.74.11,87.251.74.12,87.251.74.13,87.251.74.15,87.251.74.201,87.251.74.22,87.251.74.241,87.251.74.242,87.251.74.247,87.251.74.248,87.251.74.250,87.251.74.252,87.251.74.34,87.251.74.37,87.251.74.41,87.251.74.42,87.251.74.43,87.251.74.46,87.251.74.47,87.251.74.7,87.252.105.98,87.253.66.252,87.253.70.139,87.253.95.211,87.255.194.126,87.255.21.162,87.255.217.154,87.26.2.130,87.26.48.139,87.27.143.25,87.27.150.175,87.27.152.194,87.27.182.150,87.27.206.249,87.27.253.213,87.27.39.6,87.4.51.24,87.66.129.16,87.76.12.118,87.76.60.140,87.76.9.176,87.8.44.89] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 78"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403377; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [87.81.189.152,87.9.174.184,87.96.238.155,87.97.179.135,87.98.177.109,88.125.11.110,88.129.120.128,88.129.200.213,88.129.208.44,88.129.208.46,88.129.208.50,88.135.37.174,88.135.38.250,88.150.154.204,88.156.58.212,88.157.139.250,88.204.210.194,88.204.242.54,88.204.245.146,88.205.173.114,88.214.26.53,88.214.27.11,88.218.17.124,88.218.17.133,88.218.17.215,88.218.17.223,88.218.17.230,88.218.193.65,88.220.91.195,88.228.142.21,88.231.113.206,88.245.181.124,88.245.42.8,88.247.117.206,88.247.214.6,88.247.218.247,88.247.219.162,88.247.35.60,88.247.50.184,88.247.78.116,88.247.96.108,88.248.135.243,88.248.18.251,88.249.120.35,88.249.245.251,88.250.115.38,88.250.118.83,88.250.129.143,88.252.190.168,88.255.84.68] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 79"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403378; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [88.53.132.145,88.60.55.191,88.84.206.42,88.87.207.27,89.106.30.44,89.109.11.172,89.109.42.50,89.109.5.110,89.120.0.60,89.120.113.68,89.120.131.168,89.120.135.116,89.120.186.146,89.120.249.147,89.121.168.8,89.121.232.138,89.122.105.22,89.122.187.54,89.144.47.246,89.144.47.247,89.144.47.29,89.160.24.135,89.16.126.119,89.165.142.219,89.165.154.10,89.165.200.249,89.165.3.1,89.165.3.29,89.17.137.136,89.174.71.236,89.178.135.135,89.179.145.134,89.179.69.48,89.186.2.18,89.189.129.230,89.189.181.139,89.190.255.130,89.19.99.89,89.19.99.90,89.191.122.84,89.197.171.58,89.197.97.210,89.200.252.147,89.2.46.220,89.207.78.130,89.21.84.118,89.211.172.245,89.212.150.133,89.216.56.65,89.216.56.67] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 80"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403379; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [89.218.118.22,89.218.155.75,89.218.191.26,89.218.213.62,89.218.218.202,89.219.10.229,89.221.89.236,89.232.220.82,89.232.76.238,89.233.219.121,89.233.219.172,89.233.219.180,89.233.219.57,89.233.219.93,89.233.219.94,89.237.192.26,89.240.2.74,89.240.36.162,89.24.133.114,89.242.11.86,89.248.160.150,89.248.160.178,89.248.162.161,89.248.167.131,89.248.167.141,89.248.168.112,89.248.168.157,89.248.168.176,89.248.168.202,89.248.168.217,89.248.168.220,89.248.168.223,89.248.168.51,89.248.169.12,89.248.172.101,89.248.172.16,89.248.172.85,89.248.174.193,89.248.174.216,89.248.174.3,89.249.67.7,89.250.149.200,89.25.116.106,89.25.30.204,89.25.80.202,89.252.109.146,89.255.27.165,89.29.128.101,89.31.110.68,89.32.226.166] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 81"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403380; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [89.33.45.96,89.34.208.166,89.34.99.29,89.35.235.52,89.35.29.36,89.36.182.154,89.38.23.67,89.39.139.146,89.39.148.120,89.39.73.12,89.40.190.133,89.40.73.78,89.45.45.178,89.46.92.6,89.47.216.220,89.72.26.145,89.9.92.243,89.96.5.130,90.142.39.38,90.142.45.55,90.146.84.26,90.150.188.154,90.150.200.204,90.150.202.233,90.150.204.250,90.150.205.190,90.150.206.172,90.150.206.2,90.150.206.29,90.157.177.13,90.161.19.200,90.164.13.189,90.178.144.10,90.185.73.70,90.222.149.210,90.224.139.37,90.224.226.148,90.224.44.84,90.226.53.118,90.226.80.9,90.230.162.204,90.230.215.193,90.68.103.36,90.75.221.6,90.84.228.167,90.84.229.205,90.84.234.68,90.85.156.113,90.95.93.56,91.107.12.8] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 82"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403381; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [91.121.11.70,91.126.229.52,91.126.238.196,91.132.3.202,91.134.185.80,91.134.185.81,91.134.185.82,91.134.185.83,91.134.185.84,91.134.185.85,91.134.185.86,91.134.185.87,91.134.185.88,91.134.185.89,91.134.185.90,91.134.185.91,91.134.185.92,91.134.185.93,91.134.185.94,91.134.185.95,91.143.61.18,91.149.51.159,91.151.192.183,91.165.42.209,91.166.116.10,91.175.241.131,91.185.222.109,91.185.31.126,91.185.40.183,91.187.123.233,91.191.207.83,91.191.232.30,91.191.252.99,91.192.244.66,91.192.56.7,91.193.102.10,91.193.253.129,91.195.136.157,91.195.248.111,91.196.222.194,91.197.174.16,91.200.183.38,91.200.57.218,91.201.177.131,91.201.177.210,91.202.16.63,91.203.208.238,91.205.24.180,91.207.175.154,91.208.17.98] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 83"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403382; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [91.210.159.69,91.211.209.87,91.211.50.211,91.212.38.210,91.212.38.234,91.215.191.184,91.215.224.97,91.215.60.129,91.216.164.252,91.217.109.155,91.218.1.42,91.218.161.188,91.218.19.106,91.218.85.100,91.219.201.160,91.219.235.150,91.221.189.44,91.221.221.21,91.221.67.153,91.224.84.96,91.225.160.29,91.225.169.19,91.226.116.217,91.228.239.87,91.231.121.54,91.233.190.198,91.234.172.136,91.234.255.20,91.234.62.24,91.234.62.25,91.235.187.132,91.236.68.62,91.238.162.44,91.239.79.226,91.241.19.49,91.241.198.160,91.242.97.247,91.246.64.232,91.72.13.42,91.72.173.174,91.74.99.22,91.90.179.228,91.90.184.218,91.90.79.62,91.92.183.95,91.92.204.64,91.99.72.212,92.114.17.214,92.114.18.12,92.114.194.160] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 84"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403383; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [92.118.160.1,92.118.160.13,92.118.160.17,92.118.160.21,92.118.160.25,92.118.160.29,92.118.160.33,92.118.160.37,92.118.160.41,92.118.160.45,92.118.160.49,92.118.160.5,92.118.160.53,92.118.160.57,92.118.160.61,92.118.160.9,92.118.161.1,92.118.161.13,92.118.161.17,92.118.161.21,92.118.161.25,92.118.161.29,92.118.161.33,92.118.161.37,92.118.161.41,92.118.161.45,92.118.161.49,92.118.161.5,92.118.161.53,92.118.161.57,92.118.161.61,92.118.161.9,92.118.205.149,92.118.205.64,92.118.234.234,92.118.234.242,92.118.37.61,92.118.37.68,92.118.37.70,92.118.37.83,92.118.37.86,92.118.37.88,92.118.37.97,92.118.37.99,92.119.160.145,92.124.146.23,92.171.7.18,92.185.6.93,92.189.0.110,92.189.187.21] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 85"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403384; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [92.19.186.150,92.19.222.184,92.222.199.126,92.241.80.34,92.242.207.18,92.242.70.24,92.247.114.98,92.247.119.131,92.253.113.233,92.254.236.33,92.27.134.126,92.27.196.33,92.27.26.28,92.27.65.213,92.27.90.28,92.28.167.167,92.34.107.222,92.34.112.141,92.35.224.120,92.35.84.110,92.38.86.46,92.42.11.26,92.43.104.99,92.45.196.143,92.45.199.50,92.46.127.238,92.46.166.198,92.46.220.190,92.47.105.155,92.50.136.162,92.52.208.245,92.52.223.37,92.52.39.107,92.53.64.203,92.53.65.40,92.53.65.52,92.60.239.64,92.62.253.20,92.62.65.128,92.63.194.11,92.63.194.238,92.63.194.35,92.63.194.81,92.63.194.91,92.63.196.23,92.63.196.3,92.63.196.6,92.63.196.8,92.64.122.9,92.64.242.254] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 86"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403385; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [92.64.9.50,92.81.118.133,92.81.119.26,92.81.21.110,92.81.23.31,92.82.153.216,92.82.208.71,92.82.230.49,92.82.232.141,92.82.232.158,92.82.74.157,92.82.79.141,92.83.139.5,92.83.62.150,92.84.138.131,92.84.138.83,92.84.176.32,92.84.182.98,92.84.58.223,92.85.147.69,92.85.152.67,92.85.71.19,92.86.106.89,92.86.116.40,92.86.133.4,92.86.183.46,92.87.17.19,92.87.208.18,92.87.96.104,92.96.163.90,93.100.44.20,93.104.213.162,93.108.233.70,93.108.247.101,93.113.180.130,93.113.43.52,93.114.113.103,93.114.205.113,93.115.1.195,93.118.106.4,93.118.182.216,93.118.39.1,93.122.195.211,93.122.197.119,93.125.121.170,93.126.91.71,93.144.135.126,93.144.230.56,93.144.81.223,93.145.196.230] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 87"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403386; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [93.146.185.141,93.146.66.148,93.147.212.107,93.147.241.181,93.147.251.102,93.149.184.91,93.151.235.200,93.152.139.99,93.152.142.211,93.155.162.13,93.157.158.220,93.157.236.95,93.159.194.246,93.170.103.109,93.170.48.5,93.171.185.39,93.171.5.244,93.171.79.130,93.174.93.10,93.174.93.27,93.174.95.106,93.174.95.73,93.175.86.217,93.176.154.141,93.184.200.92,93.185.66.17,93.185.66.18,93.185.66.21,93.186.254.240,93.190.21.90,93.191.103.109,93.222.184.225,93.26.118.5,93.37.235.143,93.38.115.177,93.39.189.90,93.39.230.232,93.39.97.39,93.41.129.126,93.41.157.9,93.41.182.232,93.41.225.231,93.42.109.154,93.42.155.129,93.42.250.149,93.42.75.163,93.43.219.6,93.46.112.134,93.46.185.100,93.47.154.33] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 88"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403387; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [93.47.173.122,93.47.206.120,93.48.49.66,93.49.0.93,93.5.225.70,93.51.51.36,93.51.71.137,93.54.87.238,93.55.176.37,93.55.250.18,93.56.68.41,93.57.30.14,93.62.253.230,93.62.253.231,93.62.254.109,93.63.167.107,93.64.215.66,93.64.87.138,93.65.227.81,93.65.250.233,93.66.138.137,93.66.139.130,93.66.54.57,93.67.134.47,93.67.176.190,93.67.249.237,93.67.255.176,93.70.225.249,93.71.247.71,93.71.9.21,93.76.188.132,93.76.241.240,93.77.244.51,93.78.217.218,93.79.102.220,93.79.1.2,93.87.76.170,93.87.76.172,93.87.76.53,93.87.76.74,93.91.150.237,93.94.219.202,93.99.41.100,93.99.52.27,94.0.134.128,94.10.48.129,94.101.60.219,94.102.125.224,94.102.49.114,94.102.49.137] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 89"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403388; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [94.102.49.190,94.102.49.193,94.102.49.29,94.102.50.103,94.102.51.31,94.102.52.57,94.102.56.151,94.102.56.181,94.102.56.215,94.102.60.18,94.102.60.19,94.130.59.165,94.13.235.33,94.138.130.19,94.138.130.20,94.138.130.21,94.138.130.34,94.142.35.130,94.15.36.189,94.15.71.154,94.153.144.58,94.154.26.126,94.156.75.20,94.158.245.21,94.168.108.154,94.168.86.178,94.177.224.182,94.179.129.148,94.180.121.34,94.180.25.94,94.183.165.103,94.183.231.81,94.183.87.121,94.187.148.21,94.19.199.235,94.19.29.200,94.19.45.164,94.191.31.253,94.191.58.198,94.191.60.150,94.198.187.114,94.198.188.18,94.198.189.222,94.198.190.142,94.198.190.74,94.199.30.230,94.200.107.2,94.200.179.62,94.200.211.242,94.205.239.99] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 90"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403389; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [94.205.66.58,94.206.164.244,94.21.0.251,94.225.237.5,94.228.26.22,94.23.176.17,94.23.49.58,94.231.130.172,94.231.164.168,94.236.200.194,94.236.253.230,94.24.229.218,94.242.222.57,94.244.140.95,94.244.31.200,94.245.20.160,94.253.12.176,94.254.23.186,94.254.48.193,94.254.74.39,94.255.187.135,94.255.247.17,94.255.247.18,94.255.247.25,94.255.247.4,94.255.247.9,94.41.157.193,94.41.84.3,94.41.97.163,94.45.121.217,94.46.223.163,94.50.162.191,94.53.196.70,94.59.140.48,94.59.187.211,94.60.161.209,94.60.242.131,94.60.243.214,94.65.11.141,94.65.246.112,94.66.0.192,94.67.160.105,94.67.207.12,94.67.80.116,94.68.66.39,94.69.60.159,94.70.165.96,94.71.92.155,94.71.97.168,94.77.225.243] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 91"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403390; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [94.79.55.196,94.89.40.90,94.97.42.181,95.104.78.143,95.105.52.21,95.106.159.234,95.107.198.103,95.107.32.81,95.111.116.183,95.128.242.174,95.129.183.71,95.13.33.13,95.131.10.118,95.134.195.166,95.137.150.86,95.140.40.90,95.14.152.120,95.141.135.171,95.141.142.154,95.141.142.46,95.141.225.114,95.141.37.69,95.141.44.106,95.142.84.234,95.144.137.216,95.154.77.69,95.155.12.59,95.155.237.90,95.155.36.152,95.161.158.195,95.161.7.188,95.165.141.191,95.165.142.201,95.165.166.151,95.165.219.222,95.165.243.162,95.168.171.165,95.169.214.169,95.170.187.190,95.188.95.147,95.189.109.183,95.213.177.123,95.213.177.124,95.213.177.125,95.213.177.126,95.217.183.163,95.217.190.106,95.217.214.220,95.217.214.221,95.217.214.222] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 92"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403391; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [95.217.214.223,95.217.214.225,95.217.214.226,95.217.214.227,95.217.214.228,95.229.149.107,95.231.144.232,95.232.157.4,95.234.236.101,95.236.81.140,95.242.178.12,95.246.12.141,95.246.47.102,95.247.118.163,95.252.220.47,95.255.100.89,95.255.31.198,95.255.82.116,95.255.93.189,95.31.241.178,95.31.253.200,95.38.61.185,95.42.209.45,95.43.223.127,95.45.98.87,95.47.248.123,95.51.186.245,95.51.224.2,95.52.231.57,95.56.205.26,95.57.218.103,95.57.99.135,95.59.137.130,95.59.143.29,95.6.21.60,95.6.42.186,95.65.43.3,95.67.13.186,95.69.254.20,95.71.126.178,95.71.148.250,95.76.103.219,95.77.10.14,95.77.118.131,95.77.126.206,95.77.99.180,95.79.101.229,95.80.108.79,95.80.108.8,95.80.87.83] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 93"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403392; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [95.85.12.122,95.85.85.5,95.87.15.137,95.87.29.136,95.87.37.103,95.9.116.157,95.9.139.200,95.9.143.252,95.9.145.210,95.9.229.135,95.9.248.2,95.9.50.46,95.97.42.186,96.224.32.210,96.234.20.218,96.238.63.166,96.242.174.18,96.246.180.213,96.250.98.103,96.255.250.230,96.29.218.228,96.36.101.238,96.39.47.154,96.41.29.228,96.43.169.37,96.47.122.230,96.48.158.15,96.56.150.24,96.56.205.210,96.66.125.214,96.66.204.241,96.68.124.117,96.68.45.185,96.68.92.22,96.71.40.62,96.71.79.205,96.72.177.137,96.73.119.66,96.73.56.75,96.75.123.186,96.75.133.125,96.76.174.161,96.79.191.133,96.80.238.22,96.80.251.85,96.80.89.253,96.81.166.84,96.81.49.9,96.82.134.211,96.84.182.170] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 94"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403393; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [96.85.147.237,96.86.107.113,96.87.237.210,96.87.61.117,96.88.59.245,96.88.66.73,96.90.11.113,96.90.167.53,96.90.8.209,96.9.72.40,96.9.78.45,96.93.215.217,97.105.129.229,97.105.15.251,97.105.39.161,97.105.61.172,97.71.137.75,97.74.229.113,97.75.141.117,97.75.239.232,97.76.88.18,97.77.7.231,97.90.58.34,97.93.250.114,98.100.143.234,98.116.230.2,98.126.159.150,98.126.16.126,98.126.7.234,98.128.130.63,98.14.117.172,98.142.163.244,98.164.140.222,98.175.176.145,98.191.6.172,98.202.0.134,98.211.211.31,98.212.185.248,98.213.192.2,98.217.127.52,98.222.153.221,98.224.134.64,98.23.122.25,98.254.122.118,98.30.160.158,98.4.191.90,98.5.117.188,98.6.162.66,98.6.198.194,98.6.205.218] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 95"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403394; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [98.6.213.242,98.6.214.182,98.6.233.50,99.1.237.68,99.105.91.245,99.106.27.205,99.13.124.52,99.229.179.186,99.239.176.60,99.239.188.27,99.243.16.225,99.245.114.77,99.245.23.207,99.255.208.105,99.44.78.234,99.67.57.104,99.97.218.164,100.24.71.236,100.33.109.99,100.33.112.5,100.33.91.173,100.38.102.191,100.38.122.182,100.38.240.68,100.40.15.74,100.8.47.129,100.8.77.59,100.8.79.226,100.8.86.166,101.108.108.231,101.109.119.58,101.109.250.103,101.109.253.59,101.128.239.102,101.128.73.26,101.128.74.157,101.128.77.240,101.142.110.74,101.16.160.137,101.188.109.139,101.200.210.27,101.203.172.89,101.203.175.192,101.224.30.202,101.226.241.74,101.227.38.37,101.230.8.148,101.234.76.77,101.251.192.61,101.251.241.81] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 96"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403395; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [101.251.241.82,101.251.99.49,101.254.115.180,101.254.147.190,101.254.182.206,101.254.192.54,101.254.208.9,101.255.122.9,101.30.158.178,101.36.138.132,101.36.138.88,101.36.148.82,101.36.160.246,101.36.179.159,101.50.57.47,101.51.12.151,101.53.100.115,101.53.101.16,101.53.102.102,101.64.145.187,101.67.109.15,101.69.206.211,101.70.26.239,101.78.0.236,101.83.252.212,101.85.191.106,101.85.248.112,101.89.67.29,101.89.91.176,101.95.111.142,101.95.188.82,101.98.102.7,101.99.52.220,101.99.53.200,101.99.7.235,102.129.224.132,102.152.62.153,102.164.44.243,102.189.202.32,103.100.209.176,103.100.209.58,103.100.210.64,103.100.211.16,103.10.87.54,103.103.88.242,103.105.56.193,103.105.56.50,103.106.148.120,103.106.211.126,103.106.236.213] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 97"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403396; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [103.107.198.78,103.107.245.45,103.107.63.236,103.110.132.153,103.114.104.233,103.114.104.241,103.114.107.129,103.117.192.87,103.117.60.14,103.118.95.82,103.119.104.206,103.119.105.47,103.119.144.218,103.121.90.58,103.122.110.114,103.122.32.118,103.123.65.22,103.126.24.82,103.127.28.105,103.129.222.135,103.129.64.159,103.130.214.172,103.131.169.157,103.131.180.193,103.132.95.122,103.133.107.234,103.133.109.142,103.135.160.130,103.136.42.77,103.136.75.213,103.138.10.6,103.138.108.120,103.138.206.41,103.139.44.122,103.139.45.115,103.140.183.250,103.141.234.41,103.143.208.215,103.144.148.171,103.145.12.25,103.145.12.29,103.145.12.43,103.145.12.48,103.145.12.50,103.145.12.58,103.145.12.59,103.145.12.65,103.145.12.75,103.145.12.80,103.145.13.10] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 98"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403397; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [103.145.13.11,103.145.13.12,103.145.13.14,103.145.13.4,103.145.13.5,103.145.13.6,103.145.13.8,103.145.13.9,103.145.253.87,103.146.11.62,103.146.74.1,103.15.140.126,103.15.140.140,103.15.74.152,103.16.199.133,103.16.202.160,103.17.100.229,103.17.88.36,103.18.162.231,103.193.191.30,103.195.238.155,103.195.4.139,103.195.5.51,103.196.127.210,103.196.46.251,103.199.99.134,103.200.4.82,103.200.56.29,103.20.212.240,103.20.30.203,103.204.221.5,103.205.180.57,103.205.56.93,103.205.7.98,103.206.170.33,103.207.170.53,103.207.56.201,103.209.100.238,103.210.170.8,103.21.149.102,103.21.149.92,103.214.141.136,103.214.157.69,103.214.229.236,103.215.245.163,103.215.80.70,103.216.216.115,103.218.242.190,103.219.112.1,103.219.112.31] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 99"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403398; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)
alert ip [103.219.112.48,103.219.112.63,103.219.29.56,103.219.32.147,103.219.36.44,103.221.252.34,103.224.6.107,103.226.169.145,103.226.186.130,103.226.207.20,103.226.7.141,103.228.204.238,103.228.45.34,103.228.53.17,103.228.53.59,103.229.147.235,103.230.110.229,103.230.111.90,103.230.180.41,103.230.239.230,103.231.209.227,103.231.252.120,103.231.42.28,103.233.4.29,103.233.76.246,103.234.21.3,103.234.21.6,103.234.21.76,103.235.169.188,103.236.193.242,103.236.254.18,103.238.200.62,103.239.165.42,103.239.252.66,103.240.100.100,103.240.77.52,103.241.164.30,103.242.0.129,103.242.225.238,103.242.239.123,103.245.198.246,103.246.113.65,103.246.113.9,103.247.158.126,103.247.218.41,103.247.227.3,103.248.83.226,103.249.192.79,103.249.87.182,103.250.147.209] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 100"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403399; rev:56872; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity Major, created_at 2013_10_08, updated_at 2020_04_20;)