# # Emerging Threats Tor rules. # # These will tell you if someone using Tor for source anonymization is communicating with your network. # # Tor in itself isn't inherently hostile. In many environments that may be a very suspicious way # to communicate. # # More information available at doc.emergingthreats.net/bin/view/Main/TorRules # # Please submit any feedback or ideas to support@emergingthreats.net or the emerging-sigs mailing list # #************************************************************* # # Copyright (c) 2003-2024, Emerging Threats # All rights reserved. # # Redistribution and use in source and binary forms, with or without modification, are permitted provided that the # following conditions are met: # # * Redistributions of source code must retain the above copyright notice, this list of conditions and the following # disclaimer. # * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the # following disclaimer in the documentation and/or other materials provided with the distribution. # * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived # from this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE # USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # # VERSION 5542 # Updated 2024-05-31 00:30:01 alert tcp [102.130.117.167,103.109.101.105,103.126.161.54,103.129.222.46,103.163.218.11,103.172.134.26,103.193.179.233,103.208.86.5,103.251.167.10,103.251.167.20] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 1"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520000; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [103.253.24.18,103.28.52.93,104.167.242.116,104.167.242.117,104.192.1.138,104.192.3.74,104.219.232.126,104.219.236.100,104.244.72.132,104.244.73.136] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 2"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520001; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.244.73.190,104.244.73.193,104.244.73.43,104.244.74.23,104.244.74.97,104.244.75.74,104.244.77.192,104.244.77.208,104.244.78.162,104.244.78.233] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 3"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520002; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.244.79.44,104.244.79.50,104.244.79.61,107.172.13.143,107.172.31.146,107.172.31.165,107.174.138.172,107.174.231.197,107.181.245.162,107.181.245.163] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 4"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520003; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.181.245.164,107.181.245.165,107.181.245.166,107.189.10.175,107.189.11.111,107.189.11.113,107.189.1.160,107.189.1.167,107.189.1.175,107.189.1.198] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 5"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520004; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.12.3,107.189.12.7,107.189.12.88,107.189.13.180,107.189.13.251,107.189.13.253,107.189.13.254,107.189.13.91,107.189.14.106,107.189.14.4] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 6"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520005; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.14.43,107.189.1.80,107.189.1.9,107.189.2.108,107.189.2.248,107.189.28.199,107.189.29.103,107.189.30.236,107.189.30.69,107.189.30.86] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 7"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520006; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.3.11,107.189.31.134,107.189.31.187,107.189.31.225,107.189.31.232,107.189.31.33,107.189.3.148,107.189.3.249,107.189.3.94,107.189.4.12] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 8"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520007; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.4.158,107.189.4.209,107.189.5.121,107.189.5.18,107.189.5.19,107.189.5.7,107.189.6.124,107.189.6.57,107.189.7.114,107.189.7.141] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 9"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520008; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.7.144,107.189.7.161,107.189.7.168,107.189.7.47,107.189.8.133,107.189.8.136,107.189.8.16,107.189.8.181,107.189.8.226,107.189.8.238] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 10"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520009; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.8.5,107.189.8.56,107.189.8.65,108.181.124.143,108.181.27.205,108.181.69.243,108.61.189.136,109.104.153.22,109.169.33.163,109.69.67.17] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 11"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520010; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.70.100.1,109.70.100.2,109.70.100.3,109.70.100.4,109.70.100.5,109.70.100.6,109.70.100.65,109.70.100.66,109.70.100.67,109.70.100.68] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 12"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520011; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.70.100.69,109.70.100.70,109.70.100.71,118.163.74.160,121.78.28.175,123.253.35.32,125.212.241.131,128.127.180.156,128.31.0.13,130.193.10.21] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 13"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520012; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [130.193.15.186,135.125.205.25,136.244.111.163,138.59.18.110,139.162.249.209,139.99.172.11,139.99.8.57,141.98.11.62,141.98.119.106,142.44.234.69] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 14"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520013; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [143.110.156.176,144.172.118.4,144.172.118.55,144.172.73.11,144.172.73.6,144.217.80.80,146.59.35.246,146.59.35.38,146.70.164.210,146.70.81.186] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 15"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520014; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [147.45.116.145,147.45.78.34,149.202.79.101,149.202.79.129,149.56.22.133,149.56.44.47,151.80.148.159,152.89.233.169,154.16.116.61,155.138.161.171] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 16"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520015; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [160.119.249.240,161.35.129.51,162.247.72.192,162.247.72.199,162.247.74.200,162.247.74.201,162.247.74.202,162.247.74.204,162.247.74.206,162.247.74.213] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 17"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520016; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [162.247.74.216,162.247.74.217,162.247.74.27,162.247.74.7,162.247.74.74,162.251.5.152,163.172.45.102,163.5.143.76,164.132.172.209,165.73.242.163] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 18"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520017; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [166.70.207.2,167.99.208.41,171.25.193.20,171.25.193.234,171.25.193.235,171.25.193.25,171.25.193.77,171.25.193.78,171.25.193.79,171.25.193.80] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 19"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520018; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.104.164.133,172.104.182.84,172.104.214.41,172.104.243.155,172.105.161.162,172.232.164.52,172.234.33.174,172.81.131.110,172.81.131.111,172.81.131.139] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 20"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520019; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.81.131.156,173.230.142.131,173.232.195.137,173.232.195.144,173.232.195.146,173.249.57.253,176.118.193.33,176.121.81.51,176.126.253.190,176.58.100.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 21"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520020; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [176.97.114.202,178.162.209.56,178.17.170.184,178.17.170.23,178.17.171.102,178.17.174.14,178.17.174.164,178.175.131.141,178.175.142.26,178.175.148.209] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 22"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520021; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.20.55.16,178.20.55.182,178.218.144.18,178.218.144.51,178.218.144.64,178.218.144.96,178.218.144.99,178.31.59.214,178.31.63.144,179.43.128.16] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 23"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520022; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [179.43.159.194,179.43.159.195,179.43.159.196,179.43.159.197,179.43.159.198,179.43.159.199,179.43.159.200,179.43.159.201,179.43.159.78,179.43.167.205] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 24"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520023; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [179.43.182.232,179.43.182.58,179.48.251.188,180.150.226.99,184.105.48.40,185.100.85.132,185.100.85.22,185.100.85.23,185.100.85.24,185.100.85.25] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 25"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520024; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.100.87.136,185.100.87.139,185.100.87.174,185.100.87.192,185.100.87.250,185.100.87.253,185.100.87.41,185.106.102.102,185.106.94.195,185.107.70.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 26"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520025; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.112.144.11,185.112.146.167,185.113.128.30,185.117.215.9,185.129.61.1,185.129.61.10,185.129.61.129,185.129.61.2,185.129.61.3,185.129.61.4] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 27"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520026; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.129.61.5,185.129.61.6,185.129.61.7,185.129.61.8,185.129.61.9,185.129.62.62,185.129.62.63,185.130.44.108,185.130.44.59,185.130.47.58] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 28"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520027; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.141.147.129,185.142.239.49,185.146.232.234,185.146.232.243,185.148.3.217,185.14.97.37,185.153.197.227,185.154.110.142,185.154.110.17,185.165.169.239] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 29"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520028; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.165.171.84,185.165.190.111,185.170.114.25,185.177.151.34,185.181.60.135,185.181.61.115,185.181.61.142,185.181.61.18,185.183.157.214,185.183.159.40] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 30"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520029; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.191.204.254,185.193.158.134,185.193.52.180,185.193.66.127,185.195.237.238,185.195.71.12,185.195.71.244,185.207.107.130,185.207.107.216,185.220.100.240] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 31"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520030; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.100.241,185.220.100.242,185.220.100.243,185.220.100.244,185.220.100.245,185.220.100.246,185.220.100.247,185.220.100.248,185.220.100.249,185.220.100.250] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 32"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520031; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.100.251,185.220.100.252,185.220.100.253,185.220.100.254,185.220.100.255,185.220.101.0,185.220.101.1,185.220.101.10,185.220.101.100,185.220.101.101] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 33"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520032; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.102,185.220.101.103,185.220.101.104,185.220.101.105,185.220.101.106,185.220.101.107,185.220.101.108,185.220.101.109,185.220.101.11,185.220.101.110] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 34"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520033; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.12,185.220.101.128,185.220.101.13,185.220.101.130,185.220.101.132,185.220.101.133,185.220.101.134,185.220.101.135,185.220.101.136,185.220.101.137] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 35"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520034; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.138,185.220.101.139,185.220.101.14,185.220.101.140,185.220.101.141,185.220.101.142,185.220.101.143,185.220.101.144,185.220.101.145,185.220.101.146] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 36"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520035; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.147,185.220.101.149,185.220.101.15,185.220.101.150,185.220.101.152,185.220.101.153,185.220.101.154,185.220.101.155,185.220.101.156,185.220.101.157] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 37"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520036; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.158,185.220.101.159,185.220.101.16,185.220.101.160,185.220.101.161,185.220.101.162,185.220.101.163,185.220.101.164,185.220.101.166,185.220.101.167] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 38"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520037; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.168,185.220.101.169,185.220.101.17,185.220.101.170,185.220.101.171,185.220.101.172,185.220.101.173,185.220.101.174,185.220.101.175,185.220.101.176] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 39"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520038; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.177,185.220.101.178,185.220.101.179,185.220.101.18,185.220.101.180,185.220.101.181,185.220.101.182,185.220.101.183,185.220.101.185,185.220.101.186] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 40"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520039; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.187,185.220.101.188,185.220.101.189,185.220.101.19,185.220.101.190,185.220.101.191,185.220.101.2,185.220.101.20,185.220.101.21,185.220.101.22] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 41"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520040; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.23,185.220.101.24,185.220.101.25,185.220.101.26,185.220.101.27,185.220.101.28,185.220.101.29,185.220.101.3,185.220.101.30,185.220.101.31] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 42"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520041; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.32,185.220.101.33,185.220.101.34,185.220.101.35,185.220.101.36,185.220.101.37,185.220.101.38,185.220.101.39,185.220.101.4,185.220.101.40] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 43"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520042; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.41,185.220.101.42,185.220.101.43,185.220.101.44,185.220.101.45,185.220.101.46,185.220.101.47,185.220.101.48,185.220.101.49,185.220.101.5] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 44"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520043; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.50,185.220.101.51,185.220.101.52,185.220.101.53,185.220.101.54,185.220.101.55,185.220.101.56,185.220.101.57,185.220.101.58,185.220.101.59] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 45"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520044; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.6,185.220.101.60,185.220.101.61,185.220.101.62,185.220.101.63,185.220.101.64,185.220.101.65,185.220.101.66,185.220.101.67,185.220.101.68] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 46"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520045; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.69,185.220.101.7,185.220.101.70,185.220.101.71,185.220.101.72,185.220.101.73,185.220.101.74,185.220.101.75,185.220.101.76,185.220.101.77] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 47"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520046; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.78,185.220.101.79,185.220.101.8,185.220.101.80,185.220.101.81,185.220.101.82,185.220.101.83,185.220.101.84,185.220.101.85,185.220.101.86] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 48"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520047; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.87,185.220.101.88,185.220.101.89,185.220.101.9,185.220.101.90,185.220.101.96,185.220.101.97,185.220.101.98,185.220.101.99,185.220.103.4] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 49"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520048; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.103.5,185.220.103.6,185.220.103.7,185.220.103.8,185.220.103.9,185.225.69.203,185.227.134.106,185.227.68.78,185.233.100.23,185.235.146.29] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 50"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520049; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.241.208.115,185.241.208.196,185.241.208.202,185.241.208.204,185.241.208.206,185.241.208.212,185.241.208.232,185.241.208.236,185.241.208.243,185.241.208.54] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 51"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520050; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.241.208.71,185.243.218.110,185.243.218.202,185.243.218.204,185.243.218.35,185.243.218.41,185.243.218.61,185.243.218.89,185.243.218.95,185.243.23.81] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 52"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520051; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.244.192.175,185.244.192.184,185.246.128.161,185.246.188.149,185.246.188.73,185.246.188.74,185.246.189.77,185.246.189.99,185.246.86.197,185.247.184.105] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 53"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520052; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.247.184.33,185.252.232.218,185.254.196.141,185.34.33.2,185.35.202.222,185.38.175.133,185.39.207.83,185.42.170.203,185.56.171.94,185.56.83.83] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 54"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520053; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.67.82.114,185.7.33.146,185.82.219.109,185.86.148.90,188.165.200.97,188.172.229.15,188.214.104.21,188.244.106.81,188.68.41.191,188.68.49.235] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 55"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520054; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.68.52.231,190.103.179.98,190.120.229.98,190.211.254.97,191.252.220.31,192.42.116.14,192.42.116.15,192.42.116.17,192.42.116.173,192.42.116.174] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 56"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520055; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.175,192.42.116.176,192.42.116.177,192.42.116.178,192.42.116.179,192.42.116.18,192.42.116.180,192.42.116.181,192.42.116.182,192.42.116.183] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 57"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520056; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.184,192.42.116.185,192.42.116.186,192.42.116.187,192.42.116.188,192.42.116.189,192.42.116.19,192.42.116.191,192.42.116.192,192.42.116.193] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 58"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520057; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.194,192.42.116.195,192.42.116.196,192.42.116.197,192.42.116.198,192.42.116.199,192.42.116.20,192.42.116.200,192.42.116.201,192.42.116.202] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 59"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520058; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.203,192.42.116.204,192.42.116.208,192.42.116.209,192.42.116.210,192.42.116.211,192.42.116.212,192.42.116.213,192.42.116.214,192.42.116.215] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 60"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520059; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.216,192.42.116.217,192.42.116.218,192.42.116.219,192.42.116.22,192.42.116.220,192.42.116.221,192.42.116.23,192.42.116.24,192.42.116.25] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 61"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520060; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.26,192.42.116.27,192.42.116.28,192.99.168.180,193.105.134.150,193.105.134.155,193.168.141.173,193.189.100.194,193.189.100.195,193.189.100.196] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 62"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520061; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.189.100.197,193.189.100.198,193.189.100.199,193.189.100.200,193.189.100.201,193.189.100.202,193.189.100.203,193.189.100.204,193.189.100.205,193.189.100.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 63"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520062; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.218.118.133,193.218.118.178,193.218.118.181,193.218.118.182,193.218.118.188,193.218.118.89,193.233.133.109,193.233.133.42,193.239.232.230,193.26.115.43] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 64"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520063; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.26.115.61,193.35.18.105,193.35.18.49,193.35.18.77,194.15.112.133,194.15.113.118,194.15.115.212,194.163.157.49,194.164.122.21,194.233.174.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 65"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520064; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.26.192.64,194.26.192.77,194.26.196.116,194.26.196.71,195.160.220.104,195.176.3.19,195.176.3.20,195.176.3.23,195.176.3.24,195.234.63.128] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 66"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520065; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.26.247.0,195.80.151.242,195.88.74.206,198.23.133.132,198.46.166.157,198.50.128.237,198.58.107.53,198.96.155.3,198.98.48.20,198.98.48.31] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 67"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520066; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.98.48.33,198.98.50.199,198.98.50.215,198.98.51.189,198.98.51.249,198.98.51.52,198.98.52.24,198.98.53.136,198.98.54.49,198.98.60.90] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 68"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520067; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [199.195.248.184,199.195.249.214,199.195.250.165,199.195.250.18,199.195.250.46,199.195.251.119,199.195.251.148,199.195.251.78,199.195.253.124,199.195.253.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 69"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520068; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [199.195.253.180,199.195.253.247,200.122.181.2,201.23.12.101,201.23.14.225,201.23.16.249,202.182.99.129,202.61.226.98,202.61.252.121,202.94.246.210] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 70"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520069; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [204.137.14.104,204.137.14.105,204.137.14.106,204.137.14.92,204.194.29.4,204.8.156.142,204.85.191.7,204.85.191.8,204.85.191.9,204.8.96.184] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 71"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520070; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [204.8.96.185,204.8.96.186,204.8.96.187,204.8.96.188,205.185.113.180,205.185.115.216,205.185.116.34,205.185.117.149,205.185.119.35,205.185.121.170] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 72"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520071; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [205.185.123.93,205.185.124.176,205.185.124.193,205.185.127.231,207.188.141.102,209.141.32.198,209.141.37.94,209.141.38.110,209.141.46.203,209.141.50.178] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 73"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520072; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [209.141.51.180,209.141.51.30,209.141.54.203,209.141.55.26,209.141.59.116,209.141.62.71,212.21.66.6,212.69.167.80,212.73.134.204,212.95.50.77] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 74"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520073; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.95.52.76,213.252.140.118,213.95.149.22,216.73.159.101,216.73.159.75,217.12.221.131,217.146.2.41,23.137.248.100,23.137.250.34,23.137.253.108] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 75"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520074; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.137.253.110,23.137.253.9,23.152.24.77,23.154.177.12,23.154.177.13,23.154.177.14,23.154.177.15,23.154.177.17,23.154.177.19,23.154.177.2] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 76"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520075; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.154.177.20,23.154.177.3,23.154.177.5,23.154.177.7,23.154.177.8,23.154.177.9,23.155.24.4,23.155.24.6,23.155.8.104,23.165.104.119] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 77"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520076; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.236.122.62,23.94.211.25,2.57.122.179,2.57.122.215,2.57.122.246,2.57.122.58,2.58.56.220,2.58.56.248,2.58.56.43,2.58.56.90] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 78"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520077; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2.58.95.31,2.58.95.35,2.58.95.38,27.255.75.198,31.129.22.65,31.133.0.210,31.42.185.134,35.0.127.52,37.1.201.144,37.120.239.59] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 79"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520078; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.187.5.192,37.228.129.128,37.228.129.131,37.228.129.5,37.228.129.63,37.48.70.156,38.97.116.244,45.11.59.28,45.118.133.44,45.12.3.80] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 80"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520079; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.128.232.151,45.132.246.245,45.134.225.36,45.135.132.20,45.138.16.107,45.138.16.113,45.138.16.142,45.138.16.151,45.138.16.203,45.138.16.222] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 81"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520080; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.138.16.230,45.138.16.240,45.138.16.249,45.138.16.42,45.138.16.76,45.139.122.176,45.141.215.110,45.141.215.111,45.141.215.114,45.141.215.167] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 82"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520081; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.141.215.169,45.141.215.170,45.141.215.21,45.141.215.56,45.141.215.61,45.141.215.62,45.141.215.63,45.141.215.80,45.141.215.81,45.141.215.88] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 83"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520082; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.141.215.90,45.141.215.95,45.141.215.97,45.151.167.10,45.151.167.11,45.151.167.12,45.151.167.13,45.15.157.177,45.33.20.42,45.56.104.167] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 84"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520083; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.61.184.47,45.61.185.172,45.61.186.203,45.61.187.200,45.66.35.10,45.66.35.20,45.66.35.21,45.66.35.22,45.66.35.35,45.79.170.82] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 85"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520084; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.79.177.21,45.79.50.161,45.79.66.123,45.80.158.205,45.80.158.27,45.82.121.105,45.82.121.227,45.82.122.154,45.8.22.207,45.83.104.137] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 86"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520085; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.9.148.219,45.92.1.74,45.94.31.180,45.95.169.184,45.95.169.223,45.95.169.224,45.95.169.225,45.95.169.226,45.95.169.227,45.95.169.228] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 87"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520086; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.95.169.229,45.95.169.230,45.95.169.255,45.95.202.48,46.165.243.36,46.182.21.248,46.195.208.187,46.226.164.14,46.232.251.191,46.234.47.105] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 88"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520087; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.38.255.27,50.116.60.12,50.3.182.133,50.3.182.156,51.15.249.160,51.15.59.15,51.158.115.62,51.178.45.216,51.195.166.174,51.222.142.67] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 89"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520088; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.222.84.46,51.38.113.118,51.38.81.135,51.81.222.62,51.81.254.14,5.181.80.107,5.182.86.212,51.89.153.112,51.91.18.151,5.196.8.113] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 90"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520089; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.196.95.34,5.255.100.219,5.255.100.26,5.255.103.190,5.255.103.235,5.255.104.202,5.255.111.64,5.255.114.171,5.255.115.58,5.255.117.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 91"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520090; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.255.118.244,5.255.123.164,5.255.124.150,5.255.125.196,5.255.125.41,5.255.127.222,5.255.97.221,5.255.98.151,5.255.98.198,5.255.98.23] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 92"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520091; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.255.99.108,5.255.99.124,5.255.99.147,5.255.99.5,5.2.67.226,5.2.72.110,5.2.79.179,5.2.79.190,5.34.182.203,5.42.66.6] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 93"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520092; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.42.80.232,5.42.80.233,5.42.80.234,5.42.80.235,54.36.101.21,54.36.108.162,54.36.209.253,54.36.209.254,5.45.102.93,5.45.104.176] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 94"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520093; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.45.98.162,5.79.66.19,62.133.45.2,62.171.137.169,62.182.83.179,62.182.84.146,64.227.115.78,65.38.120.122,65.38.121.164,66.146.193.33] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 95"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520094; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [66.220.242.222,66.78.40.147,66.78.40.160,67.219.109.141,71.19.144.106,72.14.179.10,72.211.49.235,72.253.202.121,74.82.47.194,77.105.146.42] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 96"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520095; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.220.196.253,77.221.157.237,77.221.159.184,77.221.159.189,77.221.159.192,77.221.159.193,77.221.159.75,77.232.143.248,77.48.28.193,77.48.28.204] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 97"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520096; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.48.28.236,77.48.28.237,77.48.28.239,77.81.247.72,77.91.85.147,77.91.86.95,77.91.87.79,78.142.18.219,79.124.8.241,79.137.198.213] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 98"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520097; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [80.210.78.252,80.241.60.207,80.67.167.81,80.67.172.162,80.82.78.14,80.94.92.106,81.16.33.42,81.17.28.95,82.118.242.36,82.153.138.119] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 99"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520098; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.153.138.182,82.153.138.24,82.197.182.161,82.221.131.5,82.221.131.71,82.221.139.190,83.217.9.73,83.96.213.63,83.97.20.77,84.16.224.227] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 100"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520099; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [84.19.182.20,84.211.225.54,84.239.46.144,84.247.165.51,84.54.51.61,84.54.51.68,84.54.51.69,85.17.9.83,85.209.133.112,85.215.76.62] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 101"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520100; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.93.218.204,86.104.194.13,87.118.110.27,87.118.116.103,87.118.116.90,87.118.122.30,87.118.122.51,87.120.254.132,88.80.20.86,89.110.68.71] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 102"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520101; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.147.108.209,89.147.108.62,89.147.108.90,89.147.109.226,89.147.110.118,89.147.110.154,89.147.110.200,89.147.110.202,89.147.110.214,89.147.110.82] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 103"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520102; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.147.111.124,89.147.111.87,89.185.85.140,89.187.143.31,89.234.157.254,89.236.112.100,89.36.231.128,89.58.18.210,89.58.26.216,89.58.41.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 104"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520103; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.58.41.251,89.58.63.200,91.103.253.141,91.132.144.59,91.202.5.104,91.203.144.194,91.206.26.26,91.208.197.144,91.208.75.153,91.208.75.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 105"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520104; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.208.75.178,91.208.75.239,91.208.75.3,91.208.75.4,91.210.59.57,91.219.236.101,91.219.237.39,91.219.237.56,91.219.239.166,91.92.109.126] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 106"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520105; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.92.109.43,92.133.238.108,92.243.24.163,92.246.138.145,92.246.84.133,92.249.48.222,93.123.12.112,93.90.74.31,93.95.225.141,93.95.228.125] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 107"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520106; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.95.228.205,93.95.230.165,93.95.230.54,93.95.231.14,93.95.231.88,93.99.104.128,93.99.104.138,93.99.104.18,93.99.104.194,94.102.51.15] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 108"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520107; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.140.115.63,94.142.241.194,94.142.244.16,94.16.112.22,94.16.116.81,94.16.116.86,94.16.121.226,94.16.121.91,94.177.106.216,94.177.106.37] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 109"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520108; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.177.106.46,94.177.106.54,94.177.106.55,94.177.106.59,94.177.106.83,94.228.163.25,94.228.169.70,94.230.208.147,94.230.208.148,94.32.66.15] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 110"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520109; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.75.225.81,95.128.43.164,95.142.161.63,95.143.193.125,95.164.4.104,95.164.46.204,95.168.173.143,95.211.210.103,95.211.244.28,96.126.98.146] any -> $HOME_NET any (msg:"ET TOR Known Tor Exit Node TCP Traffic group 111"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2520110; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) # Non-Exit Nodes alert tcp [102.130.113.9,102.130.117.167,103.109.101.105,103.126.161.54,103.129.222.46,103.163.218.11,103.172.134.26,103.193.179.233,103.208.86.5,103.251.167.10] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 1"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522000; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [103.251.167.20,103.253.24.18,103.28.52.93,104.167.242.116,104.167.242.117,104.192.1.138,104.192.3.74,104.219.232.126,104.219.236.100,104.244.72.132] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 2"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522001; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.244.73.136,104.244.73.190,104.244.73.193,104.244.73.43,104.244.74.23,104.244.74.97,104.244.75.74,104.244.77.192,104.244.77.208,104.244.78.162] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 3"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522002; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.244.78.233,104.244.79.44,104.244.79.50,104.244.79.61,107.172.13.143,107.172.31.146,107.172.31.165,107.174.138.172,107.174.231.197,107.181.245.162] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 4"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522003; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.181.245.163,107.181.245.164,107.181.245.165,107.181.245.166,107.189.10.175,107.189.11.111,107.189.11.113,107.189.1.160,107.189.1.167,107.189.1.175] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 5"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522004; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.1.198,107.189.12.3,107.189.12.7,107.189.12.88,107.189.13.180,107.189.13.251,107.189.13.253,107.189.13.254,107.189.13.91,107.189.14.106] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 6"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522005; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.14.4,107.189.14.43,107.189.1.80,107.189.1.9,107.189.2.108,107.189.2.248,107.189.28.199,107.189.29.103,107.189.30.236,107.189.30.69] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 7"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522006; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.30.86,107.189.3.11,107.189.31.134,107.189.31.187,107.189.31.225,107.189.31.232,107.189.31.33,107.189.3.148,107.189.3.249,107.189.3.94] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 8"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522007; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.4.12,107.189.4.158,107.189.4.209,107.189.5.121,107.189.5.18,107.189.5.19,107.189.5.7,107.189.6.124,107.189.6.57,107.189.7.114] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 9"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522008; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.7.141,107.189.7.144,107.189.7.161,107.189.7.168,107.189.7.47,107.189.8.133,107.189.8.136,107.189.8.16,107.189.8.181,107.189.8.226] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 10"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522009; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.8.238,107.189.8.5,107.189.8.56,107.189.8.65,108.181.124.143,108.181.27.205,108.181.69.243,108.61.189.136,109.104.153.22,109.169.33.163] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 11"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522010; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.69.67.17,109.70.100.1,109.70.100.2,109.70.100.3,109.70.100.4,109.70.100.5,109.70.100.6,109.70.100.65,109.70.100.66,109.70.100.67] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 12"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522011; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.70.100.68,109.70.100.69,109.70.100.70,109.70.100.71,118.163.74.160,121.78.28.175,123.253.35.32,125.212.241.131,128.127.180.156,128.31.0.13] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 13"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522012; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [130.193.10.21,130.193.15.186,135.125.205.25,136.244.111.163,138.59.18.110,139.162.249.209,139.99.172.11,139.99.8.57,141.98.11.62,141.98.119.106] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 14"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522013; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [142.44.234.69,143.110.156.176,144.172.118.4,144.172.118.55,144.172.73.11,144.172.73.6,144.217.80.80,146.59.35.246,146.59.35.38,146.70.164.210] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 15"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522014; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [146.70.81.186,147.45.116.145,147.45.78.34,149.202.79.101,149.202.79.129,149.56.22.133,149.56.44.47,151.80.148.159,152.89.233.169,154.16.116.61] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 16"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522015; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [155.138.161.171,160.119.249.240,161.35.129.51,162.247.72.192,162.247.72.199,162.247.74.200,162.247.74.201,162.247.74.202,162.247.74.204,162.247.74.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 17"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522016; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [162.247.74.213,162.247.74.216,162.247.74.217,162.247.74.27,162.247.74.7,162.247.74.74,162.251.5.152,163.172.45.102,163.5.143.76,164.132.172.209] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 18"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522017; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [165.73.242.163,166.70.207.2,167.99.208.41,171.25.193.20,171.25.193.234,171.25.193.235,171.25.193.25,171.25.193.77,171.25.193.78,171.25.193.79] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 19"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522018; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [171.25.193.80,172.104.164.133,172.104.182.84,172.104.214.41,172.104.243.155,172.105.161.162,172.232.164.52,172.234.33.174,172.81.131.110,172.81.131.111] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 20"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522019; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.81.131.139,172.81.131.156,173.230.142.131,173.232.195.137,173.232.195.144,173.232.195.146,173.249.57.253,176.118.193.33,176.121.81.51,176.126.253.190] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 21"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522020; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [176.58.100.98,176.97.114.202,178.162.209.56,178.17.170.184,178.17.170.23,178.17.171.102,178.17.174.14,178.17.174.164,178.175.131.141,178.175.142.26] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 22"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522021; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.175.148.209,178.20.55.16,178.20.55.182,178.218.144.18,178.218.144.51,178.218.144.64,178.218.144.96,178.218.144.99,178.31.59.214,178.31.63.144] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 23"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522022; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [179.43.128.16,179.43.159.194,179.43.159.195,179.43.159.196,179.43.159.197,179.43.159.198,179.43.159.199,179.43.159.200,179.43.159.201,179.43.159.78] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 24"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522023; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [179.43.167.205,179.43.182.232,179.43.182.58,179.48.251.188,180.150.226.99,184.105.48.40,185.100.85.132,185.100.85.22,185.100.85.23,185.100.85.24] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 25"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522024; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.100.85.25,185.100.87.136,185.100.87.139,185.100.87.174,185.100.87.192,185.100.87.250,185.100.87.253,185.100.87.41,185.106.102.102,185.106.94.195] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 26"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522025; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.107.70.56,185.112.144.11,185.112.146.167,185.113.128.30,185.117.215.9,185.129.61.1,185.129.61.10,185.129.61.129,185.129.61.2,185.129.61.3] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 27"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522026; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.129.61.4,185.129.61.5,185.129.61.6,185.129.61.7,185.129.61.8,185.129.61.9,185.129.62.62,185.129.62.63,185.130.44.108,185.130.44.59] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 28"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522027; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.130.47.58,185.141.147.129,185.142.239.49,185.146.232.234,185.146.232.243,185.148.3.217,185.14.97.37,185.153.197.227,185.154.110.142,185.154.110.17] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 29"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522028; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.165.169.239,185.165.171.84,185.165.190.111,185.170.114.25,185.177.151.34,185.181.60.135,185.181.61.115,185.181.61.142,185.181.61.18,185.183.157.214] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 30"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522029; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.183.159.40,185.191.204.254,185.193.158.134,185.193.52.180,185.193.66.127,185.195.237.238,185.195.71.12,185.195.71.244,185.207.107.130,185.207.107.216] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 31"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522030; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.100.240,185.220.100.241,185.220.100.242,185.220.100.243,185.220.100.244,185.220.100.245,185.220.100.246,185.220.100.247,185.220.100.248,185.220.100.249] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 32"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522031; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.100.250,185.220.100.251,185.220.100.252,185.220.100.253,185.220.100.254,185.220.100.255,185.220.101.0,185.220.101.1,185.220.101.10,185.220.101.100] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 33"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522032; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.101,185.220.101.102,185.220.101.103,185.220.101.104,185.220.101.105,185.220.101.106,185.220.101.107,185.220.101.108,185.220.101.109,185.220.101.11] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 34"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522033; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.110,185.220.101.12,185.220.101.128,185.220.101.13,185.220.101.130,185.220.101.132,185.220.101.133,185.220.101.134,185.220.101.135,185.220.101.136] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 35"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522034; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.137,185.220.101.138,185.220.101.139,185.220.101.14,185.220.101.140,185.220.101.141,185.220.101.142,185.220.101.143,185.220.101.144,185.220.101.145] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 36"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522035; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.146,185.220.101.147,185.220.101.149,185.220.101.15,185.220.101.150,185.220.101.152,185.220.101.153,185.220.101.154,185.220.101.155,185.220.101.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 37"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522036; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.157,185.220.101.158,185.220.101.159,185.220.101.16,185.220.101.160,185.220.101.161,185.220.101.162,185.220.101.163,185.220.101.164,185.220.101.166] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 38"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522037; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.167,185.220.101.168,185.220.101.169,185.220.101.17,185.220.101.170,185.220.101.171,185.220.101.172,185.220.101.173,185.220.101.174,185.220.101.175] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 39"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522038; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.176,185.220.101.177,185.220.101.178,185.220.101.179,185.220.101.18,185.220.101.180,185.220.101.181,185.220.101.182,185.220.101.183,185.220.101.185] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 40"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522039; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.186,185.220.101.187,185.220.101.188,185.220.101.189,185.220.101.19,185.220.101.190,185.220.101.191,185.220.101.2,185.220.101.20,185.220.101.21] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 41"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522040; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.22,185.220.101.23,185.220.101.24,185.220.101.25,185.220.101.26,185.220.101.27,185.220.101.28,185.220.101.29,185.220.101.3,185.220.101.30] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 42"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522041; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.31,185.220.101.32,185.220.101.33,185.220.101.34,185.220.101.35,185.220.101.36,185.220.101.37,185.220.101.38,185.220.101.39,185.220.101.4] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 43"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522042; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.40,185.220.101.41,185.220.101.42,185.220.101.43,185.220.101.44,185.220.101.45,185.220.101.46,185.220.101.47,185.220.101.48,185.220.101.49] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 44"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522043; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.5,185.220.101.50,185.220.101.51,185.220.101.52,185.220.101.53,185.220.101.54,185.220.101.55,185.220.101.56,185.220.101.57,185.220.101.58] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 45"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522044; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.59,185.220.101.6,185.220.101.60,185.220.101.61,185.220.101.62,185.220.101.63,185.220.101.64,185.220.101.65,185.220.101.66,185.220.101.67] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 46"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522045; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.68,185.220.101.69,185.220.101.7,185.220.101.70,185.220.101.71,185.220.101.72,185.220.101.73,185.220.101.74,185.220.101.75,185.220.101.76] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 47"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522046; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.77,185.220.101.78,185.220.101.79,185.220.101.8,185.220.101.80,185.220.101.81,185.220.101.82,185.220.101.83,185.220.101.84,185.220.101.85] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 48"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522047; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.86,185.220.101.87,185.220.101.88,185.220.101.89,185.220.101.9,185.220.101.90,185.220.101.96,185.220.101.97,185.220.101.98,185.220.101.99] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 49"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522048; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.103.4,185.220.103.5,185.220.103.6,185.220.103.7,185.220.103.8,185.220.103.9,185.225.69.203,185.227.134.106,185.227.68.78,185.233.100.23] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 50"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522049; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.235.146.29,185.241.208.115,185.241.208.196,185.241.208.202,185.241.208.204,185.241.208.206,185.241.208.212,185.241.208.232,185.241.208.236,185.241.208.243] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 51"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522050; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.241.208.54,185.241.208.71,185.243.218.110,185.243.218.202,185.243.218.204,185.243.218.35,185.243.218.41,185.243.218.61,185.243.218.89,185.243.218.95] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 52"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522051; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.243.23.81,185.244.192.175,185.244.192.184,185.246.128.161,185.246.188.149,185.246.188.73,185.246.188.74,185.246.189.77,185.246.189.99,185.246.86.197] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 53"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522052; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.247.184.105,185.247.184.33,185.252.232.218,185.254.196.141,185.34.33.2,185.35.202.222,185.38.175.133,185.39.207.83,185.42.170.203,185.56.171.94] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 54"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522053; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.56.83.83,185.67.82.114,185.7.33.146,185.82.219.109,185.86.148.90,188.165.200.97,188.172.229.15,188.214.104.21,188.244.106.81,188.68.41.191] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 55"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522054; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.68.49.235,188.68.52.231,190.103.179.98,190.120.229.98,190.211.254.97,191.252.220.31,192.42.116.14,192.42.116.15,192.42.116.17,192.42.116.173] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 56"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522055; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.174,192.42.116.175,192.42.116.176,192.42.116.177,192.42.116.178,192.42.116.179,192.42.116.18,192.42.116.180,192.42.116.181,192.42.116.182] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 57"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522056; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.183,192.42.116.184,192.42.116.185,192.42.116.186,192.42.116.187,192.42.116.188,192.42.116.189,192.42.116.19,192.42.116.191,192.42.116.192] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 58"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522057; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.193,192.42.116.194,192.42.116.195,192.42.116.196,192.42.116.197,192.42.116.198,192.42.116.199,192.42.116.20,192.42.116.200,192.42.116.201] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 59"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522058; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.202,192.42.116.203,192.42.116.204,192.42.116.208,192.42.116.209,192.42.116.210,192.42.116.211,192.42.116.212,192.42.116.213,192.42.116.214] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 60"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522059; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.215,192.42.116.216,192.42.116.217,192.42.116.218,192.42.116.219,192.42.116.22,192.42.116.220,192.42.116.221,192.42.116.23,192.42.116.24] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 61"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522060; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.42.116.25,192.42.116.26,192.42.116.27,192.42.116.28,192.99.168.180,193.105.134.150,193.105.134.155,193.168.141.173,193.189.100.194,193.189.100.195] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 62"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522061; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.189.100.196,193.189.100.197,193.189.100.198,193.189.100.199,193.189.100.200,193.189.100.201,193.189.100.202,193.189.100.203,193.189.100.204,193.189.100.205] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 63"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522062; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.189.100.206,193.218.118.133,193.218.118.178,193.218.118.181,193.218.118.182,193.218.118.188,193.218.118.89,193.233.133.109,193.233.133.42,193.239.232.230] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 64"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522063; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.26.115.43,193.26.115.61,193.35.18.105,193.35.18.49,193.35.18.77,194.15.112.133,194.15.113.118,194.15.115.212,194.163.157.49,194.164.122.21] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 65"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522064; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.233.174.56,194.26.192.64,194.26.192.77,194.26.196.116,194.26.196.71,195.160.220.104,195.176.3.19,195.176.3.20,195.176.3.23,195.176.3.24] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 66"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522065; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.234.63.128,195.26.247.0,195.80.151.242,195.88.74.206,198.23.133.132,198.46.166.157,198.50.128.237,198.58.107.53,198.96.155.3,198.98.48.20] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 67"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522066; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.98.48.31,198.98.48.33,198.98.50.199,198.98.50.215,198.98.51.189,198.98.51.249,198.98.51.52,198.98.52.24,198.98.53.136,198.98.54.49] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 68"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522067; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.98.60.90,199.195.248.184,199.195.249.214,199.195.250.165,199.195.250.18,199.195.250.46,199.195.251.119,199.195.251.148,199.195.251.78,199.195.253.124] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 69"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522068; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [199.195.253.156,199.195.253.180,199.195.253.247,200.122.181.2,201.23.12.101,201.23.14.225,201.23.16.249,202.182.99.129,202.61.226.98,202.61.252.121] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 70"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522069; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [202.94.246.210,204.137.14.104,204.137.14.105,204.137.14.106,204.137.14.92,204.194.29.4,204.8.156.142,204.85.191.7,204.85.191.8,204.85.191.9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 71"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522070; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [204.8.96.184,204.8.96.185,204.8.96.186,204.8.96.187,204.8.96.188,205.185.113.180,205.185.115.216,205.185.116.34,205.185.117.149,205.185.119.35] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 72"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522071; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [205.185.121.170,205.185.123.93,205.185.124.176,205.185.124.193,205.185.127.231,207.188.141.102,209.141.32.198,209.141.37.94,209.141.38.110,209.141.46.203] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 73"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522072; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [209.141.50.178,209.141.51.180,209.141.51.30,209.141.54.203,209.141.55.26,209.141.59.116,209.141.62.71,212.21.66.6,212.69.167.80,212.73.134.204] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 74"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522073; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.95.50.77,212.95.52.76,213.252.140.118,213.95.149.22,216.73.159.101,216.73.159.75,217.12.221.131,217.146.2.41,23.137.248.100,23.137.250.34] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 75"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522074; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.137.253.108,23.137.253.110,23.137.253.9,23.152.24.77,23.154.177.12,23.154.177.13,23.154.177.14,23.154.177.15,23.154.177.17,23.154.177.19] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 76"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522075; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.154.177.2,23.154.177.20,23.154.177.3,23.154.177.5,23.154.177.7,23.154.177.8,23.154.177.9,23.155.24.4,23.155.24.6,23.155.8.104] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 77"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522076; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.165.104.119,23.236.122.62,23.94.211.25,2.57.122.179,2.57.122.215,2.57.122.246,2.57.122.58,2.58.56.220,2.58.56.248,2.58.56.43] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 78"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522077; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2.58.56.90,2.58.95.31,2.58.95.35,2.58.95.38,27.255.75.198,31.129.22.65,31.133.0.210,31.42.185.134,35.0.127.52,37.1.201.144] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 79"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522078; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.120.239.59,37.187.5.192,37.228.129.128,37.228.129.131,37.228.129.5,37.228.129.63,37.48.70.156,38.97.116.244,45.11.59.28,45.118.133.44] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 80"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522079; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.12.3.80,45.128.232.151,45.132.246.245,45.134.225.36,45.135.132.20,45.138.16.107,45.138.16.113,45.138.16.142,45.138.16.151,45.138.16.203] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 81"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522080; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.138.16.222,45.138.16.230,45.138.16.240,45.138.16.249,45.138.16.42,45.138.16.76,45.139.122.176,45.141.215.110,45.141.215.111,45.141.215.114] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 82"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522081; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.141.215.167,45.141.215.169,45.141.215.170,45.141.215.21,45.141.215.56,45.141.215.61,45.141.215.62,45.141.215.63,45.141.215.80,45.141.215.81] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 83"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522082; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.141.215.88,45.141.215.90,45.141.215.95,45.141.215.97,45.151.167.10,45.151.167.11,45.151.167.12,45.151.167.13,45.15.157.177,45.33.20.42] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 84"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522083; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.56.104.167,45.61.184.47,45.61.185.172,45.61.186.203,45.61.187.200,45.66.35.10,45.66.35.20,45.66.35.21,45.66.35.22,45.66.35.35] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 85"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522084; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.79.170.82,45.79.177.21,45.79.50.161,45.79.66.123,45.80.158.205,45.80.158.27,45.82.121.105,45.82.121.227,45.82.122.154,45.8.22.207] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 86"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522085; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.83.104.137,45.9.148.219,45.92.1.74,45.94.31.180,45.95.169.184,45.95.169.223,45.95.169.224,45.95.169.225,45.95.169.226,45.95.169.227] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 87"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522086; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.95.169.228,45.95.169.229,45.95.169.230,45.95.169.255,45.95.202.48,46.165.243.36,46.182.21.248,46.195.208.187,46.226.164.14,46.232.251.191] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 88"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522087; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.234.47.105,46.38.255.27,50.116.60.12,50.3.182.133,50.3.182.156,51.15.249.160,51.15.59.15,51.158.115.62,51.178.45.216,51.195.166.174] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 89"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522088; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.222.142.67,51.222.84.46,51.38.113.118,51.38.81.135,51.81.222.62,51.81.254.14,5.181.80.107,5.182.86.212,51.89.153.112,51.91.18.151] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 90"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522089; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.196.8.113,5.196.95.34,5.255.100.219,5.255.100.26,5.255.103.190,5.255.103.235,5.255.104.202,5.255.111.64,5.255.114.171,5.255.115.58] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 91"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522090; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.255.117.56,5.255.118.244,5.255.123.164,5.255.124.150,5.255.125.196,5.255.125.41,5.255.127.222,5.255.97.221,5.255.98.151,5.255.98.198] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 92"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522091; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.255.98.23,5.255.99.108,5.255.99.124,5.255.99.147,5.255.99.5,5.2.67.226,5.2.72.110,5.2.79.179,5.2.79.190,5.34.182.203] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 93"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522092; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.42.66.6,5.42.80.232,5.42.80.233,5.42.80.234,5.42.80.235,54.36.101.21,54.36.108.162,54.36.209.253,54.36.209.254,5.45.102.93] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 94"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522093; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.45.104.176,5.45.98.162,5.79.66.19,62.133.45.2,62.171.137.169,62.182.83.179,62.182.84.146,64.227.115.78,65.38.120.122,65.38.121.164] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 95"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522094; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [66.146.193.33,66.220.242.222,66.78.40.147,66.78.40.160,67.219.109.141,71.19.144.106,72.14.179.10,72.211.49.235,72.253.202.121,74.82.47.194] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 96"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522095; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.105.146.42,77.220.196.253,77.221.157.237,77.221.159.184,77.221.159.189,77.221.159.192,77.221.159.193,77.221.159.75,77.232.143.248,77.48.28.193] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 97"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522096; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.48.28.204,77.48.28.236,77.48.28.237,77.48.28.239,77.81.247.72,77.91.85.147,77.91.86.95,77.91.87.79,78.142.18.219,79.124.8.241] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 98"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522097; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [79.137.198.213,80.210.78.252,80.241.60.207,80.67.167.81,80.67.172.162,80.82.78.14,80.94.92.106,81.16.33.42,81.17.28.95,82.118.242.36] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 99"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522098; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.153.138.119,82.153.138.182,82.153.138.24,82.197.182.161,82.221.131.5,82.221.131.71,82.221.139.190,83.217.9.73,83.96.213.63,83.97.20.77] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 100"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522099; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [84.16.224.227,84.19.182.20,84.211.225.54,84.239.46.144,84.247.165.51,84.54.51.61,84.54.51.68,84.54.51.69,85.17.9.83,85.209.133.112] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 101"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522100; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.215.76.62,85.93.218.204,86.104.194.13,87.118.110.27,87.118.116.103,87.118.116.90,87.118.122.30,87.118.122.51,87.120.254.132,88.80.20.86] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 102"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522101; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.110.68.71,89.147.108.209,89.147.108.62,89.147.108.90,89.147.109.226,89.147.110.118,89.147.110.154,89.147.110.200,89.147.110.202,89.147.110.214] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 103"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522102; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.147.110.82,89.147.111.124,89.147.111.87,89.185.85.140,89.187.143.31,89.234.157.254,89.236.112.100,89.36.231.128,89.58.18.210,89.58.26.216] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 104"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522103; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.58.41.156,89.58.41.251,89.58.63.200,91.103.253.141,91.132.144.59,91.202.5.104,91.203.144.194,91.206.26.26,91.208.197.144,91.208.75.153] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 105"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522104; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.208.75.156,91.208.75.178,91.208.75.239,91.208.75.3,91.208.75.4,91.210.59.57,91.219.236.101,91.219.237.39,91.219.237.56,91.219.239.166] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 106"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522105; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.92.109.126,91.92.109.43,92.133.238.108,92.243.24.163,92.246.138.145,92.246.84.133,92.249.48.222,93.123.12.112,93.90.74.31,93.95.225.141] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 107"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522106; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.95.228.125,93.95.228.205,93.95.230.165,93.95.230.54,93.95.231.14,93.95.231.88,93.99.104.128,93.99.104.138,93.99.104.18,93.99.104.194] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 108"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522107; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.102.51.15,94.140.115.63,94.142.241.194,94.142.244.16,94.16.112.22,94.16.116.81,94.16.116.86,94.16.121.226,94.16.121.91,94.177.106.216] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 109"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522108; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.177.106.37,94.177.106.46,94.177.106.54,94.177.106.55,94.177.106.59,94.177.106.83,94.228.163.25,94.228.169.70,94.230.208.147,94.230.208.148] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 110"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522109; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.32.66.15,94.75.225.81,95.128.43.164,95.142.161.63,95.143.193.125,95.164.4.104,95.164.46.204,95.168.173.143,95.211.210.103,95.211.244.28] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 111"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522110; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [96.126.98.146,96.27.198.133,96.42.26.63,96.66.15.152,98.128.173.33,100.10.60.29,100.28.183.1,100.8.164.182,100.8.8.137,101.100.141.137] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 112"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522111; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [101.55.125.10,102.119.63.181,102.130.113.29,102.130.113.30,102.130.113.42,102.130.117.25,102.130.119.48,102.132.130.178,102.182.199.43,102.217.38.77] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 113"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522112; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [103.109.100.207,103.1.206.54,103.166.156.127,103.167.34.79,103.168.146.217,103.168.147.201,103.168.147.251,103.175.16.53,103.178.153.23,103.200.210.66] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 114"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522113; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [103.212.223.2,103.214.5.96,103.215.229.250,103.219.153.27,103.252.88.80,103.252.88.86,103.252.90.78,103.26.221.164,103.4.153.21,103.56.4.115] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 115"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522114; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [103.70.115.107,103.97.125.208,103.97.125.218,104.131.11.214,104.131.72.61,104.143.65.187,104.152.209.217,104.156.150.146,104.157.152.149,104.168.205.106] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 116"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522115; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.168.28.24,104.168.35.199,104.171.212.18,104.184.255.246,104.1.91.206,104.200.17.42,104.205.240.24,104.207.158.50,104.219.250.152,104.234.67.152] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 117"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522116; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.236.87.90,104.238.167.111,104.238.205.167,104.238.220.59,104.244.72.115,104.244.72.188,104.244.72.20,104.244.76.184,104.244.79.122,104.244.79.25] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 118"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522117; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.244.79.75,104.248.15.16,104.248.18.193,104.248.21.236,104.254.128.202,104.254.130.186,104.36.84.100,104.36.85.188,104.36.85.255,104.37.251.124] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 119"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522118; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [104.53.221.159,104.57.231.26,106.70.251.222,107.139.200.10,107.140.222.107,107.142.43.5,107.150.32.250,107.152.35.142,107.152.46.201,107.155.127.2] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 120"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522119; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.155.69.234,107.155.81.178,107.161.154.64,107.172.29.62,107.172.3.5,107.173.148.133,107.173.164.60,107.173.18.44,107.173.203.25,107.173.89.174] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 121"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522120; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.174.33.155,107.181.252.70,107.189.10.86,107.189.1.174,107.189.12.101,107.189.12.52,107.189.13.151,107.189.28.139,107.189.30.60,107.189.5.25] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 122"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522121; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [107.189.8.12,108.175.0.161,108.180.250.221,108.180.93.138,108.181.132.245,108.181.133.69,108.181.22.201,108.181.33.185,108.181.57.251,108.181.57.253] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 123"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522122; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [108.244.47.44,108.26.0.94,108.30.207.111,108.3.165.73,108.35.139.78,108.48.187.98,108.61.213.90,108.62.103.193,108.62.119.77,108.62.211.200] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 124"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522123; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [108.62.222.27,108.62.222.49,108.7.213.145,109.102.40.171,109.104.152.127,109.104.153.187,109.104.155.20,109.105.109.162,109.107.35.154,109.123.231.54] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 125"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522124; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.123.239.186,109.123.242.121,109.137.217.152,109.173.163.189,109.182.169.177,109.183.126.4,109.183.26.233,109.204.224.163,109.204.233.19,109.228.39.19] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 126"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522125; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.230.224.193,109.230.224.213,109.230.236.82,109.236.83.11,109.238.11.6,109.248.147.172,109.250.190.27,109.250.29.219,109.251.55.19,109.69.218.176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 127"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522126; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [109.69.218.51,109.78.227.58,109.85.75.25,109.87.25.148,109.90.31.112,109.91.141.229,109.92.177.220,110.21.65.208,111.69.37.214,113.20.28.216] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 128"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522127; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [113.20.28.243,114.23.164.80,114.34.165.141,114.35.245.150,115.69.183.102,115.70.0.68,115.97.39.39,1.160.89.104,116.12.180.234,116.12.180.237] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 129"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522128; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [116.202.104.202,116.202.117.160,116.202.150.27,116.202.179.148,116.202.2.123,116.202.224.62,116.202.237.212,116.202.251.46,116.203.158.245,116.203.17.238] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 130"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522129; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [116.203.195.42,116.203.213.119,116.203.50.182,116.203.64.212,116.203.73.143,116.255.1.163,116.255.5.89,117.53.155.113,118.160.77.239,118.160.82.34] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 131"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522130; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [118.160.83.91,118.160.85.163,118.160.89.167,118.170.6.170,118.208.136.16,118.27.12.40,119.18.35.197,119.247.13.23,119.247.239.225,119.59.127.167] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 132"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522131; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [121.127.33.4,121.139.252.129,121.50.43.135,123.208.170.43,123.253.34.26,123.255.62.137,125.229.175.208,125.30.60.31,128.0.64.148,128.127.150.28] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 133"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522132; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [128.127.57.121,128.135.164.40,128.140.116.120,128.140.81.180,128.199.131.168,128.199.146.186,128.232.18.58,128.238.62.37,128.31.0.39,128.31.0.61] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 134"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522133; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [128.52.132.189,129.126.111.54,129.13.131.140,129.146.30.37,129.150.32.113,129.151.200.208,129.151.218.233,129.151.221.228,129.152.2.215,129.152.8.9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 135"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522134; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [129.153.176.17,129.153.210.171,129.153.215.190,129.159.42.2,129.213.126.211,129.213.53.128,129.80.114.25,129.80.29.236,130.0.34.147,130.162.211.231] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 136"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522135; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [130.162.245.222,130.162.33.30,130.180.63.150,130.193.15.191,130.193.15.49,130.225.244.90,130.255.78.232,130.51.200.136,130.61.16.129,130.61.173.116] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 137"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522136; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [130.61.174.206,130.61.174.40,130.61.189.174,130.61.220.149,130.61.22.245,130.61.232.241,130.61.32.148,130.61.37.185,130.61.42.6,130.61.43.181] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 138"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522137; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [130.61.48.162,130.61.51.183,130.89.149.57,131.153.152.122,131.153.152.146,131.174.23.228,131.188.40.188,131.188.40.189,131.203.32.146,13.124.18.130] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 139"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522138; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [131.255.4.48,13.211.32.165,132.145.132.168,132.145.22.208,132.145.245.6,132.145.56.164,132.145.82.233,132.145.83.161,132.226.202.222,132.248.241.5] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 140"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522139; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [133.18.168.48,133.232.140.168,133.242.146.78,133.242.204.175,134.102.200.101,134.119.32.208,134.130.172.229,134.195.185.52,134.195.198.65,134.209.157.140] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 141"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522140; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [134.209.159.74,134.209.85.230,134.255.232.95,134.3.129.57,134.65.240.136,13.48.17.31,135.125.147.165,135.125.181.143,135.125.202.252,135.125.233.127] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 142"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522141; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [135.125.89.25,135.135.199.41,135.148.100.233,135.148.100.84,135.148.100.89,135.148.100.90,135.148.100.92,135.148.103.15,135.148.139.41,135.148.148.87] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 143"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522142; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [135.148.149.23,135.148.150.100,135.148.150.99,135.148.171.158,135.148.27.19,135.148.50.253,135.148.52.158,135.148.52.231,135.148.52.241,135.148.52.88] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 144"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522143; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [135.148.53.55,135.148.53.59,135.148.53.61,135.148.53.62,135.148.54.103,135.148.54.106,135.148.54.98,135.181.124.212,135.181.124.213,135.181.124.214] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 145"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522144; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [135.181.129.76,135.181.129.77,135.181.129.86,135.181.144.230,135.181.172.196,135.181.172.197,135.181.172.198,135.181.172.199,135.181.172.200,135.181.172.201] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 146"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522145; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [135.181.213.163,135.181.37.113,135.181.41.38,135.181.63.118,135.181.67.210,135.181.78.152,135.181.78.188,136.143.204.122,136.243.147.91,136.243.154.74] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 147"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522146; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [136.243.174.159,136.243.176.148,136.243.3.194,136.243.60.188,136.243.92.194,136.32.131.37,136.35.130.218,136.36.235.155,136.37.102.111,136.53.157.170] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 148"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522147; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [136.54.150.42,136.54.152.135,136.58.14.102,136.62.80.245,137.175.210.163,137.193.65.224,137.220.37.214,137.22.114.29,137.226.34.46,137.59.56.138] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 149"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522148; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [137.74.119.109,137.74.164.213,138.197.112.20,138.197.92.159,138.201.137.229,138.201.196.252,138.201.202.228,138.201.202.229,138.201.225.177,138.201.250.33] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 150"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522149; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [138.201.51.181,138.201.57.234,138.201.58.21,138.201.78.61,138.2.129.139,138.2.139.24,138.2.165.161,138.2.47.117,138.2.77.99,138.3.242.132] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 151"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522150; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [138.3.243.244,138.3.253.215,138.59.18.105,138.59.18.106,138.68.47.124,138.68.47.190,138.68.87.213,138.68.9.184,138.88.73.169,139.144.220.112] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 152"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522151; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [139.162.117.43,139.162.11.98,139.162.128.251,139.162.166.237,139.162.251.70,139.162.63.125,139.162.86.33,139.162.91.211,139.180.153.106,139.47.104.233] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 153"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522152; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [139.59.56.19,139.59.58.109,139.84.165.103,139.84.197.153,139.84.217.232,139.84.226.194,139.84.239.132,139.99.134.168,139.99.155.81,139.99.238.17] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 154"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522153; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [140.238.101.233,140.238.145.127,140.238.168.214,140.238.188.238,140.238.197.12,140.238.210.128,140.238.215.233,140.238.217.119,140.238.220.10,140.238.225.117] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 155"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522154; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [140.238.228.61,140.238.255.68,140.238.38.77,140.78.100.14,140.78.100.15,140.78.100.16,140.78.100.17,140.78.100.18,140.78.100.19,140.78.100.20] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 156"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522155; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [140.78.100.21,140.78.100.22,140.78.100.23,140.78.100.24,140.78.100.25,140.78.100.26,140.78.100.27,140.78.100.28,140.78.100.29,140.78.100.35] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 157"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522156; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [140.78.100.36,140.78.100.37,140.78.100.38,140.78.100.39,140.78.100.40,140.78.100.41,140.78.100.42,140.78.100.43,140.83.50.92,141.11.86.155] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 158"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522157; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [141.136.0.3,141.136.166.135,141.14.220.177,141.144.246.74,141.144.247.137,141.144.249.242,141.145.201.126,141.145.204.50,141.145.206.8,141.145.208.153] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 159"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522158; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [141.145.210.16,141.147.117.168,141.147.36.84,141.147.45.13,141.147.47.233,141.147.54.226,141.147.69.196,141.147.92.32,141.148.10.63,141.148.158.200] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 160"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522159; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [141.148.237.212,141.148.238.129,141.148.42.164,141.154.77.33,141.255.161.167,141.3.63.26,14.137.92.39,141.43.203.237,141.79.10.16,141.94.199.35] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 161"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522160; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [141.94.31.205,141.98.11.131,141.98.136.79,141.98.234.128,141.98.8.102,142.11.201.90,142.132.151.131,142.132.157.35,142.132.204.165,142.132.212.158] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 162"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522161; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [142.171.161.79,142.44.129.21,142.44.187.223,142.44.227.24,142.44.243.133,142.44.247.102,142.54.179.158,142.93.191.77,142.93.216.242,142.93.228.59] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 163"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522162; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [143.198.133.116,143.198.148.206,143.198.38.18,143.244.172.37,143.248.39.71,143.47.179.12,143.47.224.149,143.47.225.45,143.47.240.168,143.47.244.209] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 164"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522163; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [143.47.34.118,143.47.35.181,143.47.57.133,143.89.37.231,144.168.44.18,144.168.44.26,144.172.118.5,144.172.118.53,144.172.118.64,144.172.118.66] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 165"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522164; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [144.172.118.72,144.172.118.79,144.202.26.106,144.202.69.160,144.202.98.106,144.2.101.81,144.2.112.79,144.21.35.217,144.21.38.88,144.21.43.199] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 166"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522165; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [144.21.52.220,144.217.103.5,144.217.179.60,144.217.32.158,144.217.4.166,144.217.74.229,144.217.90.187,144.217.94.159,144.24.144.245,144.24.17.44] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 167"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522166; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [144.24.176.131,144.24.193.134,144.24.232.2,144.24.98.92,144.48.81.141,144.48.81.149,144.48.81.150,144.48.81.160,144.6.169.226,144.6.197.157] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 168"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522167; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [144.76.104.119,144.76.154.13,144.76.159.218,144.76.162.202,144.76.166.141,144.76.166.199,144.76.168.36,144.76.175.205,144.76.200.80,144.76.201.253] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 169"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522168; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [144.76.223.174,144.76.26.58,144.76.3.174,144.76.3.182,144.76.56.43,144.76.81.198,144.76.86.5,144.91.125.15,144.91.125.239,144.91.66.153] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 170"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522169; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [144.91.77.179,144.91.90.86,145.236.83.214,145.239.1.189,145.239.136.129,145.239.206.236,145.239.206.31,145.239.2.213,145.239.41.102,145.239.81.57] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 171"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522170; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [145.239.81.58,145.239.93.126,145.40.194.172,146.0.36.21,146.0.36.87,146.0.40.193,146.103.26.41,146.185.253.130,146.185.253.53,146.190.16.208] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 172"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522171; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [146.190.224.96,146.190.28.32,146.190.96.130,146.19.168.223,146.19.173.181,146.19.173.215,146.19.213.120,146.19.254.130,146.199.246.31,146.56.154.169] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 173"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522172; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [146.56.99.34,146.59.12.188,146.59.19.112,146.59.197.114,146.59.233.240,146.59.234.220,146.59.44.132,146.70.111.19,146.70.120.58,146.70.51.75] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 174"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522173; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [146.70.57.10,146.70.57.18,146.70.80.101,146.70.80.18,146.70.80.19,146.70.86.74,147.12.183.39,147.135.110.109,147.135.112.139,147.135.114.245] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 175"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522174; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [147.135.114.98,147.135.129.19,147.135.16.147,147.135.16.185,147.135.31.134,147.135.4.214,147.135.54.178,147.135.64.217,147.135.65.134,147.135.65.26] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 176"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522175; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [147.135.65.87,147.135.70.168,147.182.247.173,147.189.192.35,147.45.77.219,147.78.102.104,147.78.102.25,147.78.102.3,147.78.102.59,148.113.162.135] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 177"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522176; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [148.113.2.108,148.251.123.209,148.251.125.117,148.251.130.242,148.251.130.243,148.251.130.245,148.251.130.246,148.251.136.16,148.251.151.125,148.251.183.205] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 178"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522177; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [148.251.208.18,148.251.211.211,148.251.236.209,148.251.41.235,148.251.46.115,148.251.51.34,148.251.83.53,148.251.85.195,148.251.90.115,148.251.91.87] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 179"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522178; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [148.66.36.43,148.71.136.248,14.9.101.224,149.102.132.21,149.102.133.226,149.102.7.241,149.143.101.143,149.154.123.105,149.154.152.121,149.154.154.155] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 180"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522179; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [149.154.157.80,149.154.159.177,149.154.159.87,149.202.84.199,149.210.248.195,149.28.135.180,149.28.170.126,149.28.58.137,149.56.126.142,149.56.130.187] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 181"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522180; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [149.56.185.255,149.56.38.170,149.56.45.200,150.136.171.160,150.221.28.106,150.230.10.235,150.230.12.55,150.230.20.28,150.230.253.242,150.230.39.121] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 182"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522181; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [150.230.47.73,150.43.248.24,151.115.54.191,151.115.74.228,151.189.64.113,151.196.45.212,151.237.2.48,151.237.82.153,151.26.82.115,151.49.58.87] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 183"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522182; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [151.51.162.164,151.80.32.172,151.80.41.7,15.204.11.248,15.204.11.249,15.204.140.9,15.204.14.102,15.204.141.10,15.204.141.14,15.204.141.95] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 184"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522183; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [15.204.142.37,15.204.143.192,15.204.166.155,15.204.166.245,15.204.183.156,15.204.199.7,15.204.220.109,15.204.226.3,15.204.227.206,15.204.227.208] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 185"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522184; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [15.204.234.61,15.204.235.110,15.204.245.166,15.204.57.248,15.204.58.11,15.204.87.223,15.235.130.1,15.235.149.126,152.53.0.121,152.53.15.127] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 186"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522185; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [152.53.15.144,152.53.15.246,152.53.17.83,152.53.18.185,152.53.18.201,152.53.18.94,152.53.19.3,152.53.32.145,152.67.108.225,152.67.112.12] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 187"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522186; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [152.67.219.161,152.67.230.135,152.67.71.206,152.69.170.253,152.69.198.49,152.70.132.189,152.70.165.114,152.70.175.13,152.86.12.4,152.89.104.58] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 188"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522187; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [152.89.106.43,152.89.107.62,152.89.170.188,152.89.170.201,152.89.170.34,152.89.170.55,152.89.254.46,152.89.92.206,153.120.42.137,154.12.162.242] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 189"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522188; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [154.12.162.243,154.12.162.244,154.12.162.245,154.12.162.246,154.12.162.247,154.12.162.248,154.12.162.249,154.12.162.250,154.12.162.251,154.12.162.252] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 190"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522189; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [154.12.162.253,154.12.162.254,154.204.60.149,154.26.128.243,154.26.155.22,154.53.164.140,155.138.135.131,155.138.194.213,155.248.193.178,155.248.194.143] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 191"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522190; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [155.248.227.210,155.254.60.103,155.254.60.194,156.57.38.205,157.147.128.249,157.201.16.40,157.245.184.13,157.245.84.78,157.245.96.142,157.90.112.145] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 192"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522191; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [157.90.131.201,157.90.148.231,157.90.150.245,157.90.183.103,157.90.212.53,157.90.250.217,157.90.77.166,157.90.92.115,158.101.103.203,158.101.116.58] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 193"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522192; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [158.101.146.240,158.101.146.45,158.101.163.78,158.101.181.77,158.101.203.38,158.101.204.117,158.140.230.233,158.174.145.139,158.178.202.50,158.180.20.125] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 194"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522193; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [158.180.25.76,158.220.100.158,158.247.202.139,158.247.220.29,158.247.225.136,158.247.244.10,158.255.212.178,158.255.215.41,158.51.121.164,158.51.125.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 195"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522194; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [158.58.173.78,158.69.1.24,158.69.187.63,158.69.204.36,158.69.205.247,158.69.205.92,158.69.207.216,158.69.48.49,159.196.118.218,159.196.89.240] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 196"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522195; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [159.203.23.218,159.65.125.72,159.65.14.241,159.69.11.74,159.69.138.31,159.69.152.157,159.69.153.203,159.69.156.131,159.69.202.246,159.69.206.86] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 197"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522196; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [159.69.21.196,159.69.36.3,159.69.71.228,159.89.103.239,159.89.143.47,160.119.249.24,160.119.253.103,160.119.253.114,160.251.138.244,160.251.175.176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 198"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522197; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [160.251.46.239,161.34.68.10,161.53.160.104,161.97.132.254,161.97.184.88,162.157.210.69,162.19.171.180,162.19.204.163,162.192.36.227,162.19.242.17] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 199"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522198; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [162.19.244.234,162.19.246.43,162.19.246.63,162.19.252.175,162.231.171.29,162.237.207.53,162.243.173.63,162.247.153.131,162.250.191.15,162.251.116.10] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 200"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522199; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [162.251.116.106,162.251.116.18,162.251.116.26,162.251.116.34,162.251.116.50,162.251.116.82,162.251.117.10,162.251.119.10,162.251.119.2,162.251.156.68] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 201"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522200; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [162.251.166.210,162.43.48.54,162.55.131.67,162.55.163.223,162.55.177.164,162.55.253.244,162.55.48.243,162.55.58.248,162.55.84.59,162.83.219.229] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 202"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522201; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [163.172.11.88,163.172.13.237,163.172.182.26,163.172.45.4,163.172.70.175,163.172.76.56,163.172.93.6,163.5.121.253,163.5.159.230,164.132.226.30] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 203"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522202; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [164.132.23.184,164.132.75.248,164.215.103.126,164.68.106.94,164.68.113.149,164.68.121.40,164.90.152.167,164.92.72.234,165.140.117.247,165.22.113.233] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 204"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522203; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [165.22.122.81,165.22.230.164,165.22.245.208,165.227.34.240,165.227.34.241,165.227.35.102,166.1.173.49,167.114.36.23,167.172.200.8,167.179.90.242] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 205"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522204; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [167.179.99.77,167.235.112.134,167.235.15.221,167.235.177.161,167.235.179.232,167.235.249.14,167.235.61.89,167.71.86.85,167.86.122.9,167.86.127.130] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 206"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522205; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [167.86.66.168,167.86.74.109,167.86.85.117,167.88.174.198,167.99.12.241,167.99.193.203,168.100.9.173,168.103.163.58,168.103.87.18,168.119.62.31] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 207"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522206; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [168.138.150.255,168.181.185.147,170.133.2.81,170.39.49.168,170.64.129.106,170.64.175.63,170.64.190.214,170.64.208.4,170.64.216.180,171.25.193.9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 208"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522207; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [171.66.3.87,172.0.47.78,172.104.12.69,172.104.143.42,172.104.148.219,172.104.226.248,172.105.199.155,172.105.219.152,172.105.237.238,172.105.242.117] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 209"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522208; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.105.35.201,172.105.47.96,172.105.53.186,172.105.6.34,172.105.68.180,172.105.88.119,172.114.8.83,172.221.148.156,172.232.162.176,172.232.184.34] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 210"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522209; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.232.24.166,172.233.129.176,172.233.152.242,172.233.154.111,172.233.160.133,172.233.175.219,172.233.176.211,172.233.202.49,172.233.50.150,172.234.30.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 211"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522210; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.241.140.247,172.241.140.249,172.241.224.145,172.241.229.13,172.241.23.114,172.241.251.132,172.245.106.179,172.245.134.171,172.245.214.70,172.245.23.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 212"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522211; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [172.245.55.112,172.81.131.87,172.86.106.116,172.86.74.6,172.86.75.186,172.93.102.139,172.93.106.189,172.96.172.157,172.98.195.205,173.164.132.129] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 213"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522212; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [173.183.34.26,173.19.17.148,173.212.200.241,173.212.225.208,173.212.231.228,173.212.236.169,173.212.254.192,173.230.137.91,173.230.154.90,173.249.55.230] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 214"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522213; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [173.249.8.113,173.255.228.134,173.255.236.85,173.255.245.116,173.46.81.36,173.52.85.105,173.73.134.86,173.73.202.94,173.88.182.35,174.128.250.163] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 215"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522214; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [174.128.250.164,174.128.250.165,174.128.250.166,174.162.181.9,174.172.230.224,174.182.41.185,174.21.185.161,174.34.132.72,174.45.64.77,174.53.159.181] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 216"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522215; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [174.93.160.240,175.212.206.103,176.10.107.180,176.10.232.207,176.103.63.227,176.107.176.31,176.117.59.117,176.118.193.106,176.119.203.63,176.123.1.144] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 217"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522216; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [176.123.2.99,176.123.3.252,176.123.7.172,176.123.8.5,176.126.84.25,176.198.159.33,176.223.141.106,176.31.35.149,176.58.101.9,176.58.121.159] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 218"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522217; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [176.9.123.122,176.9.23.30,176.9.38.121,176.9.39.196,176.95.148.103,176.9.52.214,176.9.61.78,176.9.63.240,176.97.70.16,176.9.85.41] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 219"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522218; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [176.9.90.88,177.104.76.97,177.200.193.81,178.12.255.116,178.128.159.121,178.128.32.152,178.128.96.39,178.162.154.226,178.162.194.210,178.165.126.221] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 220"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522219; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.170.10.3,178.170.10.39,178.17.170.168,178.17.170.172,178.17.170.254,178.17.170.77,178.17.171.113,178.17.174.239,178.175.148.218,178.200.140.242] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 221"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522220; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.200.168.70,178.201.8.36,178.202.108.105,178.202.113.62,178.202.85.152,178.215.224.107,178.215.228.25,178.215.228.78,178.218.144.113,178.222.250.92] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 222"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522221; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.235.205.202,178.239.222.241,178.248.249.172,178.254.12.152,178.254.18.25,178.254.20.38,178.254.23.189,178.254.24.208,178.254.25.106,178.254.26.126] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 223"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522222; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.254.29.190,178.254.32.134,178.254.35.229,178.254.36.62,178.254.37.141,178.254.37.96,178.254.38.159,178.254.41.111,178.254.43.240,178.254.44.163] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 224"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522223; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.254.44.54,178.254.45.235,178.254.74.82,178.255.220.24,178.26.174.118,178.30.116.115,178.32.136.221,178.32.139.118,178.32.143.167,178.32.193.196] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 225"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522224; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.32.220.61,178.32.41.33,178.32.60.161,178.33.253.170,178.33.36.64,178.62.222.199,178.62.24.212,178.62.94.243,178.63.116.157,178.63.173.42] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 226"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522225; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.63.19.126,178.63.3.190,178.63.40.99,178.63.41.183,178.63.43.153,178.63.52.50,178.63.68.78,178.79.134.196,178.79.154.219,178.79.161.177] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 227"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522226; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [178.79.163.170,178.79.183.144,179.108.106.120,179.26.138.146,179.43.134.188,179.43.134.242,179.43.139.212,179.43.139.213,179.43.141.195,179.43.147.18] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 228"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522227; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [179.43.147.19,179.43.147.20,179.43.147.21,179.43.147.22,179.43.158.213,179.43.160.164,179.43.182.16,179.43.182.217,179.43.182.235,179.43.182.252] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 229"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522228; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [179.43.182.33,179.61.251.32,179.61.251.86,180.149.44.156,180.150.77.240,180.3.89.144,180.80.144.44,18.101.10.142,18.118.173.86,181.214.58.197] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 230"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522229; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [181.214.58.205,181.214.58.40,181.214.99.212,181.215.226.65,181.215.32.131,181.215.32.138,181.215.32.162,18.130.146.107,181.47.221.134,18.180.248.176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 231"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522230; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [18.18.82.17,18.18.82.18,18.18.82.19,18.18.82.30,18.220.20.115,18.222.193.228,182.64.102.10,184.174.38.53,184.82.69.130,185.100.233.160] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 232"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522231; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.100.86.70,185.100.87.141,185.100.87.61,185.10.16.41,185.103.110.14,185.103.110.21,185.103.110.65,185.103.110.86,185.104.142.231,185.104.194.129] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 233"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522232; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.106.123.50,185.10.68.215,185.106.94.190,185.109.91.126,185.112.144.109,185.112.144.198,185.112.146.188,185.112.146.205,185.112.147.85,185.117.118.142] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 234"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522233; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.117.82.68,185.117.82.71,185.119.117.140,185.119.117.148,185.119.117.229,185.120.145.83,185.123.53.42,185.124.240.109,185.124.240.98,185.126.117.202] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 235"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522234; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.130.44.43,185.130.45.92,185.132.40.230,185.133.210.207,185.135.137.211,185.140.209.158,185.141.147.128,185.141.56.26,185.141.56.27,185.141.56.28] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 236"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522235; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.141.56.29,185.141.57.2,185.141.57.3,185.141.57.4,185.141.57.5,185.141.57.6,185.142.208.226,185.142.238.67,185.142.239.205,185.14.30.57] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 237"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522236; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.143.102.59,185.147.11.78,185.148.1.169,185.148.1.184,185.148.1.195,185.148.214.170,185.148.3.153,185.148.3.38,185.150.189.243,185.153.55.234] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 238"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522237; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.154.111.225,185.155.223.130,185.155.223.15,185.155.223.9,185.157.161.4,185.15.92.64,185.15.92.66,185.162.249.126,185.162.250.173,185.162.251.122] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 239"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522238; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.162.251.135,185.162.251.249,185.162.251.94,185.163.204.43,185.163.44.136,185.163.45.212,185.163.45.247,185.163.45.253,185.163.46.83,185.163.46.91] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 240"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522239; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.164.138.198,185.164.138.211,185.165.169.138,185.16.60.194,185.16.61.178,185.17.136.101,185.173.200.125,185.173.93.47,185.174.135.11,185.175.143.90] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 241"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522240; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.175.158.198,185.175.56.120,185.175.59.218,185.177.127.34,185.177.229.15,185.177.229.16,185.177.229.20,185.181.210.168,185.181.210.192,185.181.229.69] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 242"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522241; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.181.229.77,185.181.229.91,185.181.60.181,185.183.159.173,185.183.194.90,185.183.195.1,185.187.170.196,185.189.125.22,185.189.149.188,185.190.176.27] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 243"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522242; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.193.125.208,185.193.127.108,185.193.158.126,185.194.142.73,185.194.57.75,185.195.237.116,185.195.71.10,185.195.71.11,185.195.71.2,185.195.71.3] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 244"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522243; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.195.71.4,185.195.71.5,185.195.71.6,185.195.71.7,185.195.71.8,185.195.71.9,185.196.220.204,185.196.220.82,185.198.56.195,185.202.93.106] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 245"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522244; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.204.1.83,185.204.1.84,185.205.126.205,185.206.146.238,185.207.106.241,185.207.107.98,185.210.170.49,185.21.100.50,185.21.216.197,185.21.217.32] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 246"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522245; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.213.175.236,185.216.176.131,185.216.176.216,185.216.179.206,185.216.214.103,185.216.35.222,185.216.68.105,185.216.68.108,185.216.68.40,185.217.0.85] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 247"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522246; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.217.95.25,185.218.88.66,185.219.132.36,185.220.101.129,185.220.101.131,185.220.101.148,185.220.101.151,185.220.101.192,185.220.101.193,185.220.101.194] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 248"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522247; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.195,185.220.101.196,185.220.101.197,185.220.101.198,185.220.101.199,185.220.101.200,185.220.101.201,185.220.101.202,185.220.101.203,185.220.101.204] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 249"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522248; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.220.101.205,185.220.101.206,185.220.101.207,185.220.101.208,185.220.101.209,185.220.101.210,185.220.101.211,185.22.154.41,185.22.155.168,185.22.172.106] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 250"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522249; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.22.174.119,185.223.53.3,185.225.114.22,185.225.114.53,185.225.114.92,185.225.16.150,185.225.17.105,185.225.18.102,185.225.19.159,185.225.210.34] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 251"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522250; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.225.210.87,185.225.68.126,185.225.68.85,185.225.68.98,185.225.69.205,185.225.69.91,185.225.87.2,185.227.135.208,185.227.82.43,185.227.82.63] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 252"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522251; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.228.139.102,185.229.90.81,185.230.162.217,185.230.163.120,185.231.207.217,185.232.68.32,185.232.69.10,185.233.104.172,185.236.228.89,185.237.253.222] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 253"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522252; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.238.129.76,185.238.129.9,185.241.5.229,185.243.20.70,185.244.129.163,185.244.150.8,185.244.194.156,185.244.213.5,185.244.24.40,185.244.24.41] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 254"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522253; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.244.24.42,185.244.24.43,185.244.24.44,185.246.188.114,185.250.148.190,185.250.36.209,185.254.96.141,185.254.99.26,185.26.156.186,185.32.183.225] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 255"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522254; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.32.222.237,185.36.143.114,185.39.207.10,185.39.207.17,185.39.207.30,185.40.199.126,185.41.154.130,185.4.132.148,185.4.134.104,185.52.1.105] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 256"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522255; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.5.233.141,185.55.240.128,185.56.107.21,185.56.107.25,185.56.150.244,185.66.109.249,185.66.141.125,185.66.91.18,185.67.45.100,185.67.45.76] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 257"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522256; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.67.45.99,185.70.185.146,185.73.211.9,185.73.220.8,185.73.240.205,185.7.33.120,185.80.222.164,185.8.104.177,185.81.29.132,185.8.165.248] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 258"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522257; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.82.126.13,185.82.126.230,185.82.127.213,185.82.216.211,185.82.217.49,185.82.219.85,185.84.81.240,185.87.50.180,185.91.127.132,185.91.69.218] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 259"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522258; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [185.92.221.195,185.94.29.93,186.233.185.59,186.233.185.61,187.131.168.6,187.148.214.83,187.207.43.94,187.255.26.160,187.94.253.217,188.112.180.135] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 260"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522259; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.116.27.219,188.126.83.38,188.127.197.42,188.150.76.252,188.151.237.158,188.154.159.130,188.154.6.144,188.155.193.103,188.155.76.149,188.165.131.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 261"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522260; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.165.136.205,188.165.136.211,188.165.26.13,188.166.99.107,188.172.228.88,188.190.109.250,188.192.49.52,188.208.141.226,188.213.92.88,188.213.95.146] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 262"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522261; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.214.132.18,188.214.132.49,188.22.88.172,188.22.92.214,188.241.120.4,188.40.128.246,188.40.142.18,188.40.162.203,188.40.162.205,188.40.162.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 263"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522262; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.40.220.196,188.40.254.242,188.40.254.245,188.40.254.246,188.40.255.114,188.40.255.115,188.40.255.116,188.40.255.118,188.40.41.115,188.61.162.10] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 264"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522263; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.62.76.216,188.68.33.200,188.68.34.113,188.68.38.76,188.68.40.180,188.68.41.54,188.68.43.192,188.68.46.164,188.68.46.245,188.68.50.174] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 265"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522264; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [188.68.50.76,188.68.56.100,188.68.56.181,188.68.58.105,188.86.45.132,188.90.115.229,188.92.78.226,188.94.124.99,189.164.114.9,189.165.152.200] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 266"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522265; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [190.206.182.55,190.211.254.101,190.211.254.182,190.211.254.192,190.211.254.210,190.211.254.76,190.2.133.227,190.2.133.94,190.2.154.253,191.101.206.19] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 267"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522266; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [191.113.114.108,191.55.113.247,191.96.208.198,192.108.48.150,192.111.150.126,192.119.108.114,192.121.108.236,192.121.108.237,192.121.44.26,192.121.44.27] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 268"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522267; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.145.46.247,192.162.196.237,192.18.128.35,192.18.144.19,192.183.195.198,192.184.1.254,192.184.254.227,192.184.93.11,192.210.175.137,192.210.206.188] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 269"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522268; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.210.233.239,192.211.48.226,192.227.186.86,192.227.213.246,192.234.196.169,192.24.207.200,192.3.105.226,192.3.105.227,192.3.105.228,192.3.105.229] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 270"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522269; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.3.173.87,192.3.41.217,192.34.87.86,192.42.113.101,192.42.113.102,192.42.115.101,192.42.115.102,192.42.115.103,192.42.132.106,192.42.253.215] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 271"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522270; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.68.11.203,192.71.245.137,192.87.28.28,192.87.28.82,192.9.137.61,192.9.235.157,192.9.249.147,192.95.29.105,192.99.152.50,192.99.154.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 272"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522271; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [192.99.228.114,192.99.69.17,193.104.220.35,193.105.134.16,193.105.134.18,193.105.134.186,193.105.134.187,193.107.109.209,193.109.120.3,193.109.69.54] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 273"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522272; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.11.114.43,193.11.114.45,193.11.114.46,193.11.164.243,193.11.166.196,193.1.12.167,193.122.142.28,193.124.46.211,193.135.10.219,193.142.146.239] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 274"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522273; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.142.146.43,193.142.147.198,193.142.147.204,193.160.96.55,193.168.141.134,193.168.143.166,193.168.144.76,193.169.239.166,193.17.183.130,193.182.111.131] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 275"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522274; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.182.111.132,193.182.111.133,193.182.111.182,193.182.111.41,193.182.111.42,193.182.111.43,193.183.211.142,193.183.98.224,193.187.91.79,193.190.168.53] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 276"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522275; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.200.17.56,193.203.167.183,193.218.118.117,193.218.118.180,193.218.118.202,193.218.118.84,193.218.118.88,193.219.97.25,193.226.13.80,193.226.239.6] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 277"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522276; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.226.78.213,193.228.128.87,193.23.244.244,193.233.202.71,193.239.86.133,193.239.86.147,193.24.209.157,193.26.115.18,193.26.156.86,193.26.158.214] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 278"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522277; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.30.120.139,193.30.123.113,193.31.24.60,193.31.26.148,193.31.27.109,193.31.27.127,193.31.27.42,193.31.27.59,193.32.87.151,193.35.18.126] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 279"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522278; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.35.18.171,193.35.18.207,193.35.18.7,193.37.252.51,193.38.34.13,193.42.36.82,193.56.240.157,193.63.58.76,193.69.119.92,193.70.112.165] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 280"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522279; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [193.93.13.174,194.124.33.143,194.126.173.158,194.126.174.190,194.13.81.26,194.13.83.131,194.147.140.101,194.147.140.102,194.147.140.106,194.147.140.107] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 281"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522280; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.15.115.91,194.15.115.92,194.15.115.93,194.15.115.94,194.163.182.63,194.164.16.95,194.164.197.45,194.164.59.150,194.164.59.227,194.164.60.113] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 282"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522281; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.180.174.45,194.180.174.73,194.180.174.74,194.180.191.93,194.182.179.34,194.187.251.163,194.195.115.114,194.195.125.11,194.233.70.34,194.233.75.85] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 283"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522282; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.233.93.135,194.32.107.206,194.34.132.169,194.34.132.51,194.34.134.13,194.36.144.87,194.36.146.145,194.36.147.125,194.36.147.51,194.39.207.224] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 284"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522283; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.49.71.252,194.5.250.250,194.55.13.49,194.55.13.50,194.62.184.12,194.62.187.100,194.76.227.150,194.76.227.152,194.87.209.161,194.87.31.104] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 285"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522284; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [194.88.105.13,194.88.105.30,194.88.106.13,194.9.172.148,195.122.181.242,195.122.183.170,195.122.183.171,195.122.183.2,195.123.212.113,195.123.228.129] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 286"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522285; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.123.245.141,195.123.247.209,195.128.101.106,195.128.102.56,195.133.52.5,195.133.53.215,195.133.53.229,195.13.60.202,195.15.242.113,195.15.242.29] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 287"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522286; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.15.242.99,195.15.243.70,195.154.104.174,195.154.112.118,195.154.168.209,195.154.33.85,195.177.252.5,195.201.103.59,195.201.147.230,195.201.174.108] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 288"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522287; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.201.199.223,195.201.204.149,195.201.226.70,195.201.241.87,195.201.62.78,195.201.7.164,195.20.17.19,195.201.9.37,195.201.94.113,195.20.234.197] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 289"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522288; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.205.30.250,195.230.168.83,195.230.23.185,195.230.23.248,195.234.152.86,195.234.62.127,195.234.63.18,195.34.103.142,195.50.212.15,195.52.136.157] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 290"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522289; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.52.164.234,195.54.160.71,195.58.58.72,195.63.130.191,195.63.154.95,195.88.75.18,195.90.208.182,195.90.210.122,195.90.210.137,195.90.211.36] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 291"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522290; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [195.90.211.87,195.90.215.149,195.90.215.218,195.90.215.45,195.90.217.16,195.90.217.96,195.90.218.160,195.90.218.46,195.90.223.138,198.100.153.18] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 292"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522291; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.100.153.7,198.12.124.71,198.12.71.224,198.140.141.51,198.140.141.52,198.177.125.14,198.180.150.9,198.199.92.217,198.211.103.103,198.211.105.236] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 293"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522292; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.211.125.179,198.23.133.146,198.23.211.171,198.23.235.168,198.24.164.98,198.24.168.226,198.244.188.169,198.244.189.139,198.244.233.55,198.251.67.184] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 294"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522293; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.251.68.144,198.251.76.239,198.251.78.251,198.251.84.163,198.251.84.237,198.251.88.18,198.251.89.96,198.255.21.2,198.27.80.188,198.46.131.154] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 295"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522294; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.46.131.155,198.46.131.156,198.46.131.157,198.46.131.158,198.50.191.95,198.50.223.16,198.71.53.137,198.72.127.222,198.74.58.16,198.74.61.51] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 296"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522295; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [198.84.184.76,198.84.192.247,198.96.155.9,198.98.48.192,198.98.50.160,198.98.55.160,198.98.57.25,198.98.57.55,198.98.59.102,198.98.62.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 297"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522296; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [199.170.132.80,199.184.215.11,199.184.246.250,199.193.115.2,199.195.248.172,199.195.251.54,199.241.137.60,199.58.103.177,199.58.81.140,199.85.209.100] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 298"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522297; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [199.85.209.102,199.85.209.103,199.85.209.104,199.85.209.105,199.85.209.106,2001:0418:8006:0000:0000:0000:0000:0009,2001:0470:0001:0908:0000:0000:0000:9001,2001:0470:000d:02ed:0000:6440:0000:000a,2001:0470:000d:11bc:0000:0000:0000:472b,2001:0470:0028:003e:0000:0000:0000:62bd] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 299"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522298; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0470:0028:0287:0006:0000:0000:0001,2001:0470:006c:056b:0000:0000:0000:0002,2001:0470:0142:0005:0000:0000:0000:0048,2001:0470:0164:0002:0000:0000:0000:0002,2001:0470:1b55:0000:0000:0000:0000:0000,2001:0470:1b62:0000:0000:0000:0000:0000,2001:0470:1f07:08b9:0000:0000:0000:f7ae,2001:0470:1f09:0d10:0000:0000:0000:0019,2001:0470:1f0a:0716:0000:0000:0000:0002,2001:0470:1f10:038a:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 300"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522299; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0470:1f10:053c:0000:0000:0000:0002,2001:0470:1f11:0392:0000:0000:0000:8be1,2001:0470:1f11:0617:0000:0000:0000:010a,2001:0470:1f13:0ab7:0000:0000:0000:0021,2001:0470:1f14:0220:0000:0000:0000:0002,2001:0470:1f19:00c2:0000:0000:9090:0001,2001:0470:1f1b:01cb:0000:0000:0000:0005,2001:0470:1f1b:040a:0000:0000:0000:c35a,2001:0470:1f2d:006e:0000:feed:beef:cafe,2001:0470:5429:0000:0000:0000:0000:00b3] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 301"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522300; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0470:600d:cafe:020d:b9ff:fe18:1512,2001:0470:681e:0000:0000:0000:0c0f:0fee,2001:0470:6a7c:0000:0000:0000:0000:0000,2001:0470:7337:0010:0014:0000:0000:0000,2001:0470:76b8:0001:0000:0000:0000:0151,2001:0470:89cd:0000:f02c:cf5f:427b:c67b,2001:0470:dd6d:0000:0000:0000:0000:0021,2001:0470:deb8:00a1:0000:0000:0000:0002,2001:0470:e01f:0700:0000:0000:0000:0020,2001:0470:ec1b:0000:0000:0000:0000:0040] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 302"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522301; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0550:5a00:bb0f:0000:0000:0000:0001,2001:0550:5a00:c425:0000:0000:0000:0001,2001:0550:9601:0000:0000:0000:0000:0002,2001:0558:6017:0110:4c99:e7b6:6937:16a0,2001:0559:0327:0231:0000:0000:0000:0084,2001:0559:0327:0231:0000:0000:0000:0085,2001:0569:52f9:6600:8ba4:6072:a28d:c5d8,2001:056a:fe44:2800:0000:0000:0000:1337,2001:0610:0510:0113:0192:0042:0113:0101,2001:0610:0510:0113:0192:0042:0113:0102] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 303"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522302; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0610:0510:0115:0192:0042:0115:0101,2001:0610:0510:0115:0192:0042:0115:0102,2001:0610:0510:0115:0192:0042:0115:0103,2001:0620:20d0:0000:0000:0000:0000:0019,2001:0620:20d0:0000:0000:0000:0000:0020,2001:0620:20d0:0000:0000:0000:0000:0023,2001:0620:20d0:0000:0000:0000:0000:0024,2001:0630:0212:02a8:a6bf:01ff:fe25:b961,2001:0638:0301:f732:0000:0000:0000:0150,2001:0638:0708:30c8:0000:0000:0000:0065] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 304"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522303; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0638:a000:4140:0000:0000:ffff:0188,2001:0638:a000:4140:0000:0000:ffff:0189,2001:0648:2ffc:1225:a800:04ff:fe0c:028b,2001:0648:2ffe:0501:cc00:10ff:fe8f:0490,2001:0648:2ffe:0501:cc00:13ff:fe62:ebdd,2001:0678:0230:2132:0192:0042:0132:0106,2001:0678:0230:3028:0192:0087:0028:0028,2001:0678:0230:3028:0192:0087:0028:0082,2001:0678:0558:1000:0000:0000:0000:0244,2001:0678:06d4:4010:0000:0000:0000:01de] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 305"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522304; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0678:06d4:4020:0000:0000:0000:03b7,2001:0678:06d4:5050:0000:0000:2abe:0100,2001:0678:06d4:5120:0000:0000:0000:0151,2001:0678:06d4:5130:0000:0000:aaaa:02d9,2001:0678:06d4:5160:0000:0000:0000:03f7,2001:0678:06d4:5170:0000:0000:0000:01db,2001:0678:06d4:7410:0000:0000:0000:0316,2001:0678:06d4:9114:0000:0000:0000:0149,2001:0678:06d4:9202:0000:0000:0000:0101,2001:0678:06e1:1001:eaad:d94e:484d:4219] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 306"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522305; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0678:0848:0240:0000:0000:0000:0240,2001:0678:0a40:7001:0002:0000:0000:4711,2001:0678:0d64:564d:0000:0000:0000:070b,2001:0678:0d64:564d:0000:0000:0000:070c,2001:0678:0d64:564d:0000:0000:0000:070d,2001:0678:0d64:564d:0000:0000:0000:070e,2001:0678:0d64:564d:0000:0000:0000:070f,2001:0678:0e3c:0000:0000:0000:0000:000a,2001:0678:0e3c:0000:0000:0000:0000:000b,2001:0678:0e3c:0000:0000:0000:0000:000c] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 307"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522306; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0678:0e3c:0000:0000:0000:0000:000d,2001:067c:013c:0000:0000:0000:0000:0035,2001:067c:0440:f887:0194:0147:0140:0101,2001:067c:0440:f887:0194:0147:0140:0102,2001:067c:0440:f887:0194:0147:0140:0106,2001:067c:0440:f887:0194:0147:0140:0107,2001:067c:06ec:0203:0192:0042:0116:0173,2001:067c:06ec:0203:0192:0042:0116:0174,2001:067c:06ec:0203:0192:0042:0116:0175,2001:067c:06ec:0203:0192:0042:0116:0176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 308"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522307; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:06ec:0203:0192:0042:0116:0177,2001:067c:06ec:0203:0192:0042:0116:0178,2001:067c:06ec:0203:0192:0042:0116:0179,2001:067c:06ec:0203:0192:0042:0116:0180,2001:067c:06ec:0203:0192:0042:0116:0181,2001:067c:06ec:0203:0192:0042:0116:0182,2001:067c:06ec:0203:0192:0042:0116:0183,2001:067c:06ec:0203:0192:0042:0116:0184,2001:067c:06ec:0203:0192:0042:0116:0185,2001:067c:06ec:0203:0192:0042:0116:0186] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 309"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522308; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:06ec:0203:0192:0042:0116:0187,2001:067c:06ec:0203:0192:0042:0116:0188,2001:067c:06ec:0203:0192:0042:0116:0189,2001:067c:06ec:0203:0192:0042:0116:0191,2001:067c:06ec:0203:0192:0042:0116:0192,2001:067c:06ec:0203:0192:0042:0116:0193,2001:067c:06ec:0203:0192:0042:0116:0194,2001:067c:06ec:0203:0192:0042:0116:0195,2001:067c:06ec:0203:0192:0042:0116:0196,2001:067c:06ec:0203:0192:0042:0116:0197] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 310"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522309; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:06ec:0203:0192:0042:0116:0198,2001:067c:06ec:0203:0192:0042:0116:0199,2001:067c:06ec:0203:0192:0042:0116:0200,2001:067c:06ec:0203:0192:0042:0116:0201,2001:067c:06ec:0203:0192:0042:0116:0202,2001:067c:06ec:0203:0192:0042:0116:0203,2001:067c:06ec:0203:0192:0042:0116:0204,2001:067c:06ec:0203:0192:0042:0116:0208,2001:067c:06ec:0203:0192:0042:0116:0209,2001:067c:06ec:0203:0192:0042:0116:0210] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 311"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522310; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:06ec:0203:0192:0042:0116:0211,2001:067c:06ec:0203:0192:0042:0116:0212,2001:067c:06ec:0203:0192:0042:0116:0213,2001:067c:06ec:0203:0192:0042:0116:0214,2001:067c:06ec:0203:0192:0042:0116:0215,2001:067c:06ec:0203:0192:0042:0116:0216,2001:067c:06ec:0203:0192:0042:0116:0217,2001:067c:06ec:0203:0192:0042:0116:0218,2001:067c:06ec:0203:0192:0042:0116:0219,2001:067c:06ec:0203:0192:0042:0116:0220] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 312"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522311; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:06ec:0203:0192:0042:0116:0221,2001:067c:06ec:0203:0218:33ff:fe44:5514,2001:067c:06ec:0203:0218:33ff:fe44:5515,2001:067c:06ec:0203:0218:33ff:fe44:5517,2001:067c:06ec:0203:0218:33ff:fe44:5518,2001:067c:06ec:0203:0218:33ff:fe44:5519,2001:067c:06ec:0203:0218:33ff:fe44:5520,2001:067c:06ec:0203:0218:33ff:fe44:5522,2001:067c:06ec:0203:0218:33ff:fe44:5523,2001:067c:06ec:0203:0218:33ff:fe44:5524] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 313"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522312; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:06ec:0203:0218:33ff:fe44:5525,2001:067c:06ec:0203:0218:33ff:fe44:5526,2001:067c:06ec:0203:0218:33ff:fe44:5527,2001:067c:06ec:0203:0218:33ff:fe44:5528,2001:067c:089c:0666:0000:0000:0000:0001,2001:067c:089c:0702:01ce:01ce:babe:0001,2001:067c:089c:0702:01ce:01ce:babe:0002,2001:067c:089c:0702:01ce:01ce:babe:0003,2001:067c:089c:0702:01ce:01ce:babe:0004,2001:067c:089c:0702:01ce:01ce:babe:0005] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 314"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522313; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:089c:0702:01ce:01ce:babe:0006,2001:067c:089c:0702:01ce:01ce:babe:0007,2001:067c:089c:0702:01ce:01ce:babe:0008,2001:067c:089c:0702:01ce:01ce:babe:0009,2001:067c:089c:0702:01ce:01ce:babe:0010,2001:067c:1514:0003:0000:0000:0000:beef,2001:067c:15e0:0003:0000:0000:0fce:ad76,2001:067c:2044:1905:0000:0000:0000:0026,2001:067c:21bc:001e:0000:0000:0000:f00f,2001:067c:21bc:001e:0000:0000:0001:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 315"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522314; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:2564:a120:0000:0000:0000:0057,2001:067c:2608:0000:0000:0000:0000:0001,2001:067c:289c:0000:0000:0000:0000:0009,2001:067c:289c:0000:0000:0000:0000:0020,2001:067c:289c:0000:0000:0000:0000:0025,2001:067c:289c:0002:0000:0000:0000:0234,2001:067c:289c:0002:0000:0000:0000:0235,2001:067c:289c:0004:0000:0000:0000:0077,2001:067c:289c:0004:0000:0000:0000:0078,2001:067c:289c:0004:0000:0000:0000:0079] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 316"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522315; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:067c:289c:0004:0000:0000:0000:0080,2001:067c:2db8:0013:0000:0000:0000:0091,2001:067c:2db8:0305:0043:0dcd:f532:034f,2001:06b0:0007:0125:0000:0000:0000:0243,2001:06b0:0030:1000:0000:0000:0000:0099,2001:06b0:0030:1000:0000:0000:0000:0100,2001:06b0:0030:1000:0000:0000:0000:0101,2001:0770:0021:0193:ca1f:66ff:fec7:9862,2001:0780:0107:000b:0000:0000:0000:0085,2001:0780:0131:0013:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 317"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522316; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:07d0:4dc0:7511:a0de:bdff:fe03:1ac1,2001:07e8:f463:3500:0000:0000:0000:0000,2001:0858:0006:2001:0000:0000:0000:0003,2001:0878:0346:1cf9:446a:c4eb:4548:7061,2001:0878:0346:1cf9:446a:c4eb:4548:7062,2001:08a0:713b:f203:0000:0000:0000:0003,2001:08b0:1628:a008:0000:0000:0000:00aa,2001:08d8:1800:0196:0000:0000:0000:0001,2001:08d8:1800:05b8:0000:0000:0000:0001,2001:08d8:1800:05d7:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 318"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522317; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:08d8:1800:858a:0000:0000:0000:0001,2001:08d8:1801:0048:0000:0000:0000:0001,2001:08d8:1801:0266:0000:0000:0000:0001,2001:08d8:1801:0717:0000:0000:0000:0001,2001:08d8:1801:8156:0000:0000:0000:0001,2001:08d8:1801:8678:0000:0000:0000:0001,2001:08d8:1801:87ae:0000:0000:0000:0001,2001:08e0:1417:0000:0000:0000:0000:159b,2001:0910:1400:0107:0000:0000:0000:0002,2001:0948:0007:0002:0000:0000:0000:0163] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 319"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522318; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:09b0:0217:2b00:dca8:0cff:fe8e:89c3,2001:09b1:26fb:d900:ca7f:54ff:fe69:4033,2001:09b1:26fe:c700:786a:5f14:ca5f:7b6c,2001:09b1:26fe:c700:f231:7aff:fee1:0201,2001:09b1:403c:0000:ffff:d3da:5c99:8455,2001:09b1:9bd0:0000:0000:0000:0000:0073,2001:09b1:9bd0:0000:0000:0000:0000:0074,2001:09e8:0082:f100:d250:99ff:fec2:ffb3,2001:0a61:05a2:e601:d423:24ff:9880:e2db,2001:0ac8:007d:0041:1573:e655:4653:403a] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 320"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522319; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0b07:02e2:878a:0223:54ff:fe78:1286,2001:0b07:5d29:9575:65b5:294f:2bf4:e595,2001:0ba0:0202:0b00:0000:dead:f00d:0420,2001:0ba0:0202:d200:0000:0000:0000:0001,2001:0ba0:0203:f900:0000:0000:0000:0001,2001:0ba0:021a:d900:0000:0000:0000:0001,2001:0ba0:0234:2700:0000:0000:0000:0001,2001:0ba0:0235:7000:0000:0000:0000:0001,2001:0ba0:1800:00fe:0000:0000:0000:0001,2001:0ba0:1800:0190:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 321"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522320; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0ba0:1800:81a4:0000:0000:0000:0001,2001:0ba0:1800:81dc:0000:0000:0000:0001,2001:0ba0:1800:81dd:0000:0000:0000:0001,2001:0ba0:1800:81ef:0000:0000:0000:0001,2001:0ba0:1800:8250:0000:0000:0000:0001,2001:0ba8:01f1:f05d:0000:0000:0000:0002,2001:0bc8:0634:198a:0000:0000:0000:0001,2001:0bc8:0654:1c11:0000:0000:0000:0001,2001:0bc8:0678:1a35:0000:0000:0000:0001,2001:0bc8:0700:9212:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 322"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522321; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0bc8:0710:0f5c:dc00:00ff:fe2a:6d75,2001:0bc8:1201:0512:da5e:d3ff:fe6c:8241,2001:0bc8:1201:0608:46a8:42ff:fe3d:2743,2001:0bc8:1210:0dbf:dc00:00ff:fe34:c7c5,2001:0bc8:1210:0e4a:dc00:00ff:fe30:edd3,2001:0bc8:1210:0efe:dc00:00ff:fe31:df1f,2001:0bc8:1210:1249:dc00:00ff:fe34:c8c9,2001:0bc8:1210:124a:dc00:00ff:fe34:c8cd,2001:0bc8:1600:4127:0000:0000:0000:0001,2001:0bc8:1600:472a:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 323"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522322; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0bc8:1640:01a5:dc00:00ff:fe10:365f,2001:0bc8:1640:01ad:dc00:00ff:fe10:3587,2001:0bc8:1640:03ac:dc00:00ff:fe16:f9b9,2001:0bc8:1640:04ae:dc00:00ff:fe11:278f,2001:0bc8:1640:0777:dc00:00ff:fe12:d075,2001:0bc8:1640:1410:dc00:00ff:fe1f:deb3,2001:0bc8:1640:16d5:dc00:00ff:fe22:2981,2001:0bc8:17c0:0411:8634:97ff:fe11:7a70,2001:0bc8:1820:2436:0000:0000:0000:0001,2001:0bc8:1830:0051:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 324"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522323; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0bc8:1860:0607:0000:0000:0000:0001,2001:0bc8:1864:0c17:0000:0000:0000:0001,2001:0bc8:208a:0000:0000:0000:0000:0000,2001:0bc8:23ca:0200:0000:0000:0000:0000,2001:0bc8:2ecd:caed:746f:7200:746f:7200,2001:0bc8:30c6:0100:0000:0000:0000:dead,2001:0bc8:32d7:0185:0000:0000:0001:0001,2001:0bc8:32d7:0185:0000:0000:0002:0001,2001:0bc8:32d7:0185:0000:0000:0003:0001,2001:0bc8:32d7:0185:0000:0000:0004:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 325"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522324; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0bc8:32d7:0266:0000:0000:0000:0000,2001:0bc8:3680:bb01:0000:0000:0000:0010,2001:0bc8:47a8:1401:0000:0000:0000:0001,2001:0bc8:6010:0213:0208:a2ff:fe0c:8128,2001:0bc8:6010:0213:0208:a2ff:fe0c:8134,2001:0bf0:0666:0000:0000:0000:0000:0666,2001:0bf0:0666:0000:1c0c:49cb:1d9a:a032,2001:0df4:0f80:0001:66ec:5844:7580:0001,2001:0df4:0f80:0001:f404:8c17:0178:0001,2001:0df4:0f80:0021:578c:2d19:605f:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 326"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522325; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:0df4:0f80:0031:afd4:bc7b:dcbb:0001,2001:0df7:7e80:0100:9f2b:1d15:c713:52ad,2001:0e68:5409:0738:02e5:ae44:9368:f4f1,2001:14ba:a301:1b12:0000:0000:0000:0001,2001:14ba:ab00:ec11:0000:0000:0000:0001,2001:14ba:ab01:2ba9:0000:0000:0000:0001,2001:1600:0010:0100:0000:0000:0000:0201,2001:1600:0010:0100:0000:0000:0000:0226,2001:1600:0010:0100:0000:0000:0000:03ab,2001:1600:0010:0100:0000:0000:0000:07dd] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 327"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522326; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:1600:0013:0101:0000:0000:0000:00c5,2001:1620:0ad1:0000:0000:0000:0000:ff24,2001:1620:0ad1:0000:0000:0000:0000:ff26,2001:1620:425a:6fde:0000:0000:0000:0010,2001:1680:0101:043f:0000:0000:0000:0001,2001:16b8:b19c:2000:e65f:01ff:fe00:96c5,2001:171b:c9a0:6900:6099:d2ff:fe21:c2f0,2001:1900:0005:0002:0002:0000:0000:583a,2001:1900:0005:0002:0002:0000:0000:583b,2001:19f0:0000:48d7:0ec4:7aff:fe8f:699b] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 328"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522327; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:19f0:0000:4aba:3eec:efff:feb9:89dc,2001:19f0:0005:3f28:5400:04ff:fe02:9c74,2001:19f0:4400:69b1:5400:03ff:febb:2687,2001:19f0:4401:0f85:5400:03ff:fe32:19f3,2001:19f0:5000:1dba:5400:04ff:feae:1397,2001:19f0:5001:3165:5400:04ff:feaa:03b4,2001:19f0:5001:3d94:5400:03ff:fe7d:64dc,2001:19f0:5001:3f24:5400:04ff:fe25:ce77,2001:19f0:5401:0075:ae1f:6bff:fef5:9358,2001:19f0:5401:29c0:5400:04ff:fe3b:517d] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 329"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522328; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:19f0:5801:0dac:5400:04ff:fe7e:2f90,2001:19f0:5801:1cb0:3eec:efff:fe30:50ba,2001:19f0:6001:3ea3:0ec4:7aff:fe8f:691b,2001:19f0:6801:158a:5400:04ff:feae:4dd2,2001:19f0:7001:5bf8:5400:04ff:fe9f:92e1,2001:19f0:8000:1cae:5400:04ff:fed0:15b4,2001:19f0:8001:0f60:5400:03ff:fea9:8ed1,2001:19f0:9003:09c8:0ec4:7aff:fe8f:69aa,2001:19f0:ac00:345a:0ec4:7aff:fe8f:6599,2001:19f0:c000:ccec:5400:04ff:febb:4cb0] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 330"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522329; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:19f0:c800:21c4:5400:04ff:fed0:7af5,2001:19f0:c800:2ce1:5400:04ff:fe8b:d93b,2001:1a48:1112:0006:0122:0000:001d:0000,2001:1ad0:c4fe:0504:0000:0000:0000:0011,2001:1af8:4700:a114:0006:0000:0000:0001,2001:1b10:1000:8101:0000:0242:ac11:0003,2001:1b60:0002:0001:3935:0104:0000:0001,2001:1b60:0002:0032:4104:0104:0000:0001,2001:1b60:0003:0034:1107:0102:0000:0001,2001:1b60:0003:0221:3132:0102:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 331"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522330; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:1b60:0003:0221:4134:0101:0000:0001,2001:1b60:0003:0239:1003:0103:0000:0001,2001:1b60:0003:0239:1003:0106:0000:0001,2001:2003:f736:5600:9e3c:4b5f:41e9:e87e,200.122.181.78,2001:40e8:0000:f090:0000:0000:0000:0100,2001:41c8:0051:0490:feff:00ff:fe00:3214,2001:41d0:0001:c441:0000:0000:0000:0000,2001:41d0:0002:5555:0000:0000:0000:0001,2001:41d0:0002:7b9e:0000:0000:0000:0000] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 332"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522331; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:0002:9161:0000:0000:0000:0001,2001:41d0:0008:522c:24d9:6a97:78db:2bcb,2001:41d0:0008:9366:0000:0000:0000:0001,2001:41d0:0008:b8d9:0000:0000:0000:0001,2001:41d0:0008:bd83:0000:0000:0000:0001,2001:41d0:0008:de3d:0000:0000:0000:0001,2001:41d0:0008:e531:0000:0000:0000:0001,2001:41d0:000a:02e5:0000:0000:0000:0001,2001:41d0:000a:04ae:0000:0000:0000:0001,2001:41d0:000a:05c0:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 333"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522332; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:000a:17e8:0000:0000:0000:0001,2001:41d0:000a:1c2c:0000:0000:0123:0001,2001:41d0:000a:2054:0000:0000:0000:0001,2001:41d0:000a:2736:0000:0000:0000:0001,2001:41d0:000a:5377:0000:0000:0000:0046,2001:41d0:000a:6063:0000:0000:0000:0001,2001:41d0:000a:f308:0000:0000:0000:0001,2001:41d0:000a:fe10:0000:0000:0000:0001,2001:41d0:000a:fe22:0000:0000:0000:0001,2001:41d0:000e:03e2:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 334"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522333; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:000e:0418:0000:0000:0000:0001,2001:41d0:000e:06ac:0000:0000:0000:0001,2001:41d0:0302:2200:0000:0000:0000:220b,2001:41d0:0303:2513:0000:0000:0000:dead,2001:41d0:0304:0200:0000:0000:0000:60f1,2001:41d0:0304:0200:0000:0000:0000:632f,2001:41d0:0304:0200:0000:0000:0000:96df,2001:41d0:0304:0200:0000:0000:0000:9dce,2001:41d0:0305:2100:0000:0000:0000:0a53,2001:41d0:0305:2100:0000:0000:0000:138c] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 335"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522334; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:0305:2100:0000:0000:0000:150b,2001:41d0:0305:2100:0000:0000:0000:7cb4,2001:41d0:0401:3000:0000:0000:0000:358b,2001:41d0:0401:3100:0000:0000:0000:30dc,2001:41d0:0401:3100:0000:0000:0000:7fda,2001:41d0:0401:3200:0000:0000:0000:0c3e,2001:41d0:0401:3200:0000:0000:0000:31de,2001:41d0:0401:3200:0000:0000:0000:3efd,2001:41d0:0401:3200:0000:0000:0000:4012,2001:41d0:0403:0cd0:5679:0000:0000:2222] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 336"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522335; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:0403:1830:0014:0000:0000:0001,2001:41d0:0404:0300:0000:0000:0000:0dd2,2001:41d0:0601:1100:0000:0000:0000:01b8,2001:41d0:0601:1100:0000:0000:0000:03fd,2001:41d0:0601:1100:0000:0000:0000:108e,2001:41d0:0601:1100:0000:0000:0000:3e84,2001:41d0:0601:1100:0000:0000:0000:41f0,2001:41d0:0601:1100:0000:0000:0000:4c5f,2001:41d0:0601:1100:0000:0000:0000:5975,2001:41d0:0601:1100:0000:0000:0000:5a7f] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 337"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522336; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:0601:1100:0000:0000:0000:6648,2001:41d0:0700:05bd:0000:0000:0000:0000,2001:41d0:0700:10a2:0000:0000:0000:0000,2001:41d0:0700:482a:2cfc:0bdc:9917:0001,2001:41d0:0701:1000:0000:0000:0000:3ebf,2001:41d0:0701:1100:0000:0000:0000:0475,2001:41d0:0701:1100:0000:0000:0000:0dcf,2001:41d0:0701:1100:0000:0000:0000:1e29,2001:41d0:0701:1100:0000:0000:0000:264d,2001:41d0:0701:1100:0000:0000:0000:38fc] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 338"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522337; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:0701:1100:0000:0000:0000:4a52,2001:41d0:0701:1100:0000:0000:0000:4f60,2001:41d0:0701:1100:0000:0000:0000:6e02,2001:41d0:0701:1100:0000:0000:0000:6f0f,2001:41d0:0701:1100:0000:0000:0000:7795,2001:41d0:0701:1100:0000:0000:0000:8bb2,2001:41d0:0800:0b1f:0000:0000:0000:0000,2001:41d0:0800:0bec:0000:0000:0000:0046,2001:41d0:0800:158b:0000:0000:0000:0000,2001:41d0:0800:1f70:0000:0000:0000:0000] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 339"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522338; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:0800:2e90:13df:5ba7:c7a6:0001,2001:41d0:0801:2000:0000:0000:0000:0251,2001:41d0:0801:2000:0000:0000:0000:057d,2001:41d0:0801:2000:0000:0000:0000:0678,2001:41d0:0801:2000:0000:0000:0000:0f6e,2001:41d0:0801:2000:0000:0000:0000:15bb,2001:41d0:0801:2000:0000:0000:0000:3054,2001:41d0:0801:2000:0000:0000:0000:3eb5,2001:41d0:0801:2000:0000:0000:0000:436b,2001:41d0:0801:2000:0000:0000:0000:5466] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 340"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522339; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:41d0:1004:08c7:0000:0000:0000:0000,2001:41d0:1008:20d1:0000:0000:0000:0001,2001:4610:000a:0136:0000:0000:0000:028d,2001:4652:0554:0000:fc5f:ebc4:8297:2085,2001:4801:7825:0102:be76:4eff:fe10:0552,2001:48f8:0005:0000:ad3e:ae84:08fb:54c2,2001:4b20:0012:f001:0000:0000:0000:0105,2001:4b98:0dc0:0041:0216:3eff:fe45:aebb,2001:4b98:0dc0:0041:0216:3eff:fec9:9fda,2001:4b98:0dc0:0041:0216:3eff:fecc:52c3] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 341"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522340; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:4b98:0dc0:0043:f816:3eff:fe40:d4fd,2001:4b98:0dc0:0043:f816:3eff:fe49:506d,2001:4b98:0dc0:0043:f816:3eff:fe4f:6cae,2001:4b98:0dc0:0043:f816:3eff:fe51:df77,2001:4b98:0dc0:0043:f816:3eff:fe5f:cf14,2001:4b98:0dc0:0043:f816:3eff:fe93:b598,2001:4b98:0dc0:0045:0216:3eff:feb7:79bc,2001:4b98:0dc0:0047:0216:3eff:fe3d:888c,2001:4b98:0dc2:0055:0216:3eff:fee8:6e97,2001:4ba0:cafe:0066:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 342"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522341; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:4ba0:cafe:0072:0000:0000:0000:0001,2001:4ba0:cafe:024f:0000:0000:0000:0001,2001:4ba0:cafe:02e0:0afa:0161:acab:1312,2001:4ba0:cafe:031c:0000:0000:0000:0001,2001:4ba0:cafe:05ef:0000:0000:0000:0001,2001:4ba0:cafe:06af:0000:0000:0000:0001,2001:4ba0:cafe:0923:0000:0000:0000:0001,2001:4ba0:cafe:0daa:0000:0000:0000:0001,2001:4ba0:cafe:0e5c:0000:0000:0000:0001,2001:4ba0:cafe:0f55:dead:beef:dead:beef] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 343"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522342; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:4ba0:cafe:1267:0000:0000:0000:0001,2001:4ba0:cafe:12a1:0000:0000:0000:0000,2001:4ba0:ffa4:0078:0000:0000:0000:0000,2001:4ba0:ffa6:010c:2c1d:17f3:8e31:4d61,2001:4ba0:fff9:0131:6c4f:0000:0000:90d3,2001:4ba0:ffff:004a:0000:0000:0000:0002,2001:4ba0:ffff:0058:0000:0000:0000:0002,2001:4dd5:1cb1:0000:ba27:ebff:fef2:f7d6,2001:b011:0006:061a:e602:0ff9:7329:4d35,2001:b011:0006:09e0:d9db:f7a8:269c:8fb7] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 344"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522343; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2001:b011:0006:0b68:2145:b4d4:6d82:8f0c,2001:b011:0006:0c95:a986:c6ef:a36d:22ab,2001:b011:0011:bca8:0000:0000:0000:081e,2001:b011:4002:1edf:0000:0000:0000:000b,2001:b011:7008:50c1:056a:8186:97bb:3be9,2001:b030:2422:0000:0000:0000:0000:7234,2003:000a:0d37:e800:0011:32ff:fe2b:36b4,2003:000a:1504:6000:a03a:d1ff:fea1:8062,2003:00d7:173f:9400:0219:99ff:fe57:90f9,2003:00e5:cf4a:d600:ba27:ebff:feae:14f0] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 345"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522344; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2003:00e6:0734:a611:0a0e:a0ce:0c37:3bf9,2003:00f1:cf18:3700:21d1:97d7:cdec:03ee,2003:00f4:7713:3300:020a:e4ff:fe84:4015,201.239.24.201,20.160.225.224,202.125.83.179,202.169.99.195,202.55.71.41,202.59.9.238,202.61.193.116] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 346"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522345; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [202.61.196.212,202.61.197.87,202.61.205.33,202.61.224.170,202.61.224.179,202.61.226.150,202.61.236.66,202.61.237.56,202.61.241.225,202.61.248.18] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 347"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522346; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [202.63.72.227,203.12.12.233,203.122.194.115,203.153.77.84,203.23.128.239,203.51.38.33,203.76.225.173,204.10.194.74,204.13.154.155,204.13.164.118] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 348"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522347; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [204.137.14.60,204.137.14.69,204.144.222.250,204.8.98.85,205.185.117.232,205.185.119.222,205.185.121.159,205.185.124.120,205.185.124.164,205.185.124.189] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 349"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522348; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [205.185.125.239,206.168.240.163,206.168.240.205,206.189.148.213,206.198.210.210,206.75.30.189,206.81.31.249,207.127.92.63,207.127.93.212,207.127.93.255] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 350"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522349; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [207.127.94.135,207.134.205.114,207.153.2.192,207.153.49.56,207.174.40.194,207.180.192.66,207.180.213.181,207.180.216.146,207.180.230.109,207.180.234.231] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 351"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522350; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [207.188.145.232,207.192.70.250,207.216.170.204,207.229.65.155,207.244.78.230,207.55.47.26,207.90.194.2,208.109.189.114,208.109.215.188,208.113.128.210] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 352"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522351; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [208.113.128.254,208.113.133.68,208.113.200.33,208.113.200.37,208.115.216.54,208.115.218.134,208.115.230.19,208.38.228.104,208.38.243.113,208.65.84.97] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 353"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522352; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [208.70.148.69,208.72.154.158,208.73.102.153,208.83.232.67,209.114.126.200,209.114.126.201,209.114.126.202,209.126.4.123,209.127.116.162,209.127.117.90] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 354"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522353; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [209.127.119.162,209.127.3.50,209.133.193.6,209.133.196.18,209.133.196.22,209.133.206.38,209.135.168.56,209.141.32.241,209.141.52.110,209.141.54.168] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 355"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522354; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [209.14.69.62,209.148.46.45,209.205.191.129,209.209.10.208,209.237.82.207,209.250.2.254,209.35.32.109,209.38.145.86,209.51.188.48,209.58.145.210] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 356"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522355; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [209.58.160.138,209.58.180.236,209.58.180.90,210.165.80.18,210.223.41.251,212.111.40.177,212.114.16.232,212.129.32.142,212.129.4.84,212.132.108.187] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 357"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522356; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.132.110.104,212.132.124.245,212.132.78.65,212.132.79.65,212.144.96.29,212.146.101.18,212.159.177.198,212.159.69.155,212.162.152.105,212.162.153.159] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 358"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522357; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.162.9.158,212.193.3.237,212.193.3.59,212.21.66.25,212.227.119.130,212.227.148.248,212.227.149.79,212.227.150.117,212.227.165.251,212.227.169.190] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 359"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522358; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.227.170.28,212.227.171.107,212.227.197.40,212.227.198.49,212.227.201.187,212.227.224.217,212.227.224.245,212.227.225.216,212.227.234.153,212.227.237.231] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 360"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522359; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.227.240.17,212.227.43.225,212.227.74.176,212.227.76.37,212.227.76.91,212.237.217.108,212.24.100.138,212.25.16.159,212.32.240.165,212.44.107.82] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 361"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522360; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.46.38.238,212.47.233.86,212.51.134.25,212.51.149.67,212.51.153.6,212.51.155.104,212.60.126.148,212.7.160.189,212.73.134.242,212.83.167.220] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 362"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522361; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [212.83.171.89,212.86.32.106,212.89.225.242,213.100.213.221,213.108.108.85,213.109.161.242,213.109.162.197,213.113.1.191,213.114.238.197,213.128.141.195] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 363"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522362; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [213.133.103.134,213.136.81.89,213.138.109.144,213.139.243.22,213.144.135.21,213.144.135.22,213.144.142.24,213.144.142.26,213.152.162.181,213.152.187.205] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 364"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522363; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [213.163.70.234,213.164.193.245,213.164.201.212,213.167.242.183,213.168.190.69,213.169.148.151,213.171.194.25,213.171.214.222,213.183.48.84,213.183.56.140] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 365"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522364; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [213.183.63.36,213.202.208.174,213.202.216.179,213.202.219.251,213.202.223.75,213.206.184.75,213.211.43.139,213.227.151.21,213.239.213.220,213.239.215.221] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 366"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522365; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [213.252.245.153,213.252.245.202,213.32.104.213,213.34.104.54,213.47.154.149,213.52.128.167,213.52.39.185,213.95.190.181,216.146.25.242,216.197.207.48] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 367"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522366; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [216.205.161.171,216.218.219.41,216.225.202.136,216.238.120.187,216.238.71.59,216.239.90.19,216.73.159.106,217.100.189.28,217.100.189.29,217.103.30.38] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 368"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522367; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [217.113.181.56,217.115.127.34,217.117.29.93,217.12.202.85,217.12.203.196,217.12.203.242,217.12.206.128,217.12.221.110,217.12.221.75,217.146.2.101] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 369"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522368; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [217.150.239.92,217.155.3.245,217.155.40.118,217.160.114.102,217.160.114.209,217.160.114.94,217.160.192.232,217.160.216.38,217.160.220.18,217.160.242.229] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 370"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522369; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [217.160.244.121,217.160.9.229,217.160.98.239,217.163.129.42,217.172.180.4,217.180.225.55,217.182.73.157,217.182.75.0,217.194.154.18,217.196.147.77] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 371"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522370; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [217.197.162.19,217.199.199.250,217.226.63.99,217.235.12.139,217.238.192.200,217.23.8.2,217.251.147.128,217.25.174.216,217.255.73.122,217.70.191.83] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 372"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522371; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [217.76.139.49,217.76.159.216,217.79.179.177,217.79.181.76,217.79.181.90,217.79.252.202,217.92.175.88,217.95.76.186,218.144.130.245,220.108.59.168] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 373"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522372; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2.202.220.177,220.233.73.236,2.202.67.123,2.204.218.248,2.205.197.178,2.206.8.244,221.113.50.91,221.145.183.106,221.145.183.109,2.223.175.191] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 374"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522373; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2.226.135.138,223.25.71.54,2.24.246.103,23.105.163.117,23.105.172.1,23.105.174.243,23.106.120.42,23.108.51.104,23.108.55.71,23.111.143.202] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 375"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522374; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.111.179.34,23.111.179.98,23.111.189.202,23.122.217.236,23.126.9.217,23.130.136.139,23.134.136.5,23.135.248.225,23.135.248.226,23.135.248.227] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 376"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522375; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.135.248.228,23.135.248.229,23.135.248.230,23.135.248.231,23.135.248.232,23.135.248.233,23.135.248.234,23.137.248.147,23.137.253.26,23.137.253.27] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 377"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522376; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.137.254.14,23.141.40.7,23.142.248.63,23.154.177.10,23.154.177.11,23.154.177.16,23.154.177.18,23.154.177.21,23.154.177.22,23.154.177.23] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 378"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522377; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.154.177.24,23.154.177.25,23.154.177.4,23.154.177.6,23.156.104.141,23.157.136.251,23.157.136.252,23.157.136.253,23.160.192.240,23.162.136.129] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 379"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522378; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.162.136.141,23.162.136.175,23.162.136.92,23.165.24.4,23.166.120.35,23.227.168.106,23.227.186.186,23.227.186.194,23.236.143.194,23.236.143.34] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 380"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522379; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.237.154.138,23.237.74.106,23.237.74.90,23.237.96.90,23.247.50.183,23.253.203.194,23.29.119.122,23.29.124.34,23.81.44.113,23.82.136.14] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 381"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522380; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.82.136.232,23.82.137.85,23.82.137.99,23.83.135.203,23.83.135.225,23.83.91.155,23.88.110.231,23.88.44.26,23.88.46.11,23.92.19.230] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 382"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522381; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.92.32.138,23.92.34.105,23.92.34.106,23.92.34.107,23.92.34.108,23.92.34.109,23.92.34.110,23.92.34.111,23.92.34.112,23.92.34.113] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 383"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522382; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.92.34.115,23.92.34.116,23.92.34.117,23.92.34.118,23.92.34.120,23.92.34.121,23.92.34.122,23.92.34.123,23.92.34.124,23.92.34.125] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 384"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522383; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.92.34.40,23.92.34.41,23.92.34.42,23.92.34.43,23.92.34.45,23.93.164.234,23.94.166.66,23.94.220.202,23.94.60.158,23.94.85.226] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 385"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522384; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [23.94.85.227,23.94.85.228,23.94.85.229,23.94.85.230,2400:2413:e042:ac00:4068:95d2:aa2d:ba49,2400:38e0:0001:41bd:0000:0000:0000:00e3,2400:6180:0000:00d0:0000:0000:01a6:f001,2400:6180:0000:00d0:0000:0000:050b:9001,2400:6180:0000:00d0:0000:0000:0e7f:d001,2400:6180:0000:00d0:0000:0000:1182:e001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 386"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522385; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2400:6180:0000:00d1:0000:0000:0705:5001,2400:6180:0010:0200:0000:0000:0010:3000,2400:6180:0010:0200:0000:0000:0048:0000,2400:6180:0010:0200:0000:0000:009d:5000,2400:6180:0010:0200:0000:0000:009e:1000,2400:6180:0100:00d0:0000:0000:08bb:6001,2400:8500:1801:0406:0118:0027:0012:0040,2400:8500:1801:0478:0160:0251:0046:0239,2400:8500:2002:2950:0160:0251:0138:0244,2400:8500:2002:3164:0160:0251:0175:0176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 387"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522386; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2400:8901:0000:0000:f03c:91ff:feb1:8ece,2400:8901:0000:0000:f03c:93ff:fe68:23b3,2400:8902:0000:0000:f03c:91ff:feaf:723b,2400:8902:0000:0000:f03c:91ff:febf:0f72,2400:8902:0000:0000:f03c:91ff:fec1:94de,2400:8902:0000:0000:f03c:91ff:fede:08f5,2400:8902:0000:0000:f03c:93ff:fe12:145d,2400:8902:0000:0000:f03c:93ff:fea2:7464,2400:8902:0000:0000:f03c:94ff:fefc:3da1,2400:8907:0000:0000:f03c:94ff:fefc:3d93] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 388"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522387; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2400:c400:1002:0011:0fed:bee0:5b0d:e68f,2400:d320:2153:1275:0000:0000:0000:0001,2400:d320:3011:5449:0000:0000:0000:0001,2401:0920:1001:1111:5e7f:aca6:7af1:0001,2401:0b60:0005:8625:96c5:2d48:a93e:17d4,2401:0b60:0005:f855:410c:d769:49dc:967e,2401:2500:0102:1206:0133:0242:0146:0078,2401:2500:0102:1212:0133:0242:0204:0175,2401:5b60:0000:0001:0000:0000:0000:0045,2401:c080:2000:111f:5400:04ff:fea3:9c02] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 389"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522388; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2401:c080:2000:2617:3eec:efff:feb9:c84e,2402:1f00:8000:00d1:0014:0000:0000:0000,2402:1f00:8000:0239:0000:0000:0000:0000,2402:1f00:8000:0800:0000:0000:0000:0e5b,2402:1f00:8100:0400:0000:0000:0000:0009,2402:1f00:8100:0400:0000:0000:0000:03a8,2402:1f00:8300:01a7:8f62:7a09:7478:0001,2403:5806:db86:0000:0000:feed:beef:cafe,2403:580a:935a:0100:0250:56ff:fe87:668f,2404:0e80:6e6b:0000:0000:0000:b00b:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 390"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522389; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2404:0e80:6e6b:0000:0000:0000:b00b:0140,2404:4400:4130:1b00:c71e:3e55:4d0d:7764,2406:3400:0240:6d01:6db4:01a6:1f94:0100,2406:8c00:0000:3401:0133:0018:0168:0048,2406:8dc0:6004:60d7:cbc3:569a:3eee:42d5,2407:1c00:6100:05b0:0000:0000:0000:0000,2407:3640:2165:5159:0000:0000:0000:0001,2407:3640:2165:5160:0000:0000:0000:0001,2407:3640:2165:5161:0000:0000:0000:0001,2407:3640:2165:5162:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 391"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522390; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2407:d140:0001:012a:6000:6000:012a:4906,240b:0010:92c2:5a00:0215:5dff:fe44:d501,240b:0013:65e0:0900:8557:7d07:0ef6:9efe,24.151.1.51,24.151.170.153,24.154.181.201,24.191.62.109,24.202.11.237,24.212.137.85,24.246.25.51] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 392"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522391; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [24.4.7.49,24.49.115.19,24.53.51.144,2.47.197.48,2.56.10.29,2.56.206.124,2.56.96.214,2.56.98.121,2.56.98.134,2.57.122.81] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 393"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522392; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2.58.52.163,2.58.95.71,2.59.254.204,2600:1700:0131:00c1:0000:0000:0000:0465,2600:1700:0840:c380:0000:0000:0030:0050,2600:1700:0840:c380:0000:0000:0030:0051,2600:1700:3688:42b0:0000:0000:0000:0045,2600:1700:4051:2840:0000:0000:0000:0002,2600:1f16:04bb:dd00:b8b3:a3a9:94a9:6284,2600:3c00:0000:0000:f03c:91ff:fe96:1cd9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 394"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522393; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2600:3c00:0000:0000:f03c:91ff:fee9:6481,2600:3c00:0000:0000:f03c:93ff:fe2b:34f6,2600:3c01:0000:0000:f03c:91ff:fe96:a8d7,2600:3c01:0000:0000:f03c:91ff:fedf:8cc1,2600:3c01:0000:0000:f03c:92ff:fe05:dd4c,2600:3c01:0000:0000:f03c:93ff:fe09:e4e1,2600:3c01:0000:0000:f03c:93ff:fe25:b23e,2600:3c01:e000:016f:0000:e000:0000:0000,2600:3c02:0000:0000:f03c:91ff:fedf:a49f,2600:3c02:0000:0000:f03c:92ff:fed1:4cc7] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 395"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522394; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2600:3c02:0000:0000:f03c:94ff:fe72:5aa7,2600:3c03:0000:0000:f03c:91ff:fe16:8f3e,2600:3c03:0000:0000:f03c:91ff:fe73:8ad1,2600:3c03:0000:0000:f03c:91ff:fe93:5318,2600:3c03:0000:0000:f03c:91ff:fedb:19ed,2600:3c03:0000:0000:f03c:91ff:fedf:407b,2600:3c03:0000:0000:f03c:92ff:fed8:d9ef,2600:3c03:0000:0000:f03c:93ff:fed9:3504,2600:3c03:0000:0000:f03c:94ff:fed1:8c69,2600:3c03:0000:0000:f03c:94ff:fee2:7891] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 396"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522395; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2600:3c03:e000:0034:ffff:ffff:ffff:ffff,2600:3c03:e000:01fe:0000:0000:0000:0001,2600:3c04:0000:0000:f03c:93ff:fece:e1d1,2600:3c05:0000:0000:f03c:93ff:fe6e:0ff2,2600:3c05:0000:0000:f03c:93ff:fe6e:ec97,2600:3c06:0000:0000:f03c:93ff:fe6e:0ff6,2600:3c06:0000:0000:f03c:93ff:fe6e:ecf2,2600:3c0a:0000:0000:f03c:93ff:fe6e:0f32,2600:3c0a:0000:0000:f03c:93ff:fe6e:eccf,2600:3c0a:0000:0000:f03c:94ff:fe5a:3a17] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 397"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522396; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2600:3c0e:0000:0000:f03c:94ff:feac:947f,2600:4040:207e:0101:021b:21ff:fe36:fd2e,2600:4040:2959:e500:2c04:69ff:fe66:614e,2600:4040:2e7e:4f00:0000:0000:0000:2000,2600:4040:3037:e600:0000:0000:0000:1e16,2600:4040:9431:3800:0000:0000:0000:1594,2600:4040:b0de:5f00:7285:c2ff:fed3:0c3c,2600:4041:5806:1300:84e0:c0ff:feea:faa9,2600:8801:0100:0006:0000:0000:0000:0da0,2601:0246:c200:b633:0000:0000:0000:08a7] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 398"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522397; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2601:0280:5e80:7ed0:5144:60a2:9b8c:2725,2601:0547:0e81:2c90:f52d:e125:df57:04d7,2601:0645:0b81:0820:0828:2a3a:e24c:b348,2601:0840:4780:7872:79e2:8705:f92a:df68,2602:0291:0069:0000:0000:0000:0000:0063,2602:02a8:004b:0000:0000:0000:0000:d23e,2602:02a8:0052:0000:0000:0000:0000:5486,2602:02e6:0000:0004:0000:0000:0000:0000,2602:02e6:0000:0006:0000:0000:0000:0000,2602:f9ab:0500:1600:0000:0000:0000:000a] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 399"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522398; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2602:f9f3:0000:0002:0000:0000:0000:003d,2602:f9f3:0000:0002:0000:0000:0000:0091,2602:fa11:0020:102f:0000:0000:0000:000a,2602:fa11:0040:1007:0000:0000:0000:000a,2602:fa4f:0202:6f2a:368a:09f7:e371:3ba5,2602:fafd:0f0e:000d:0000:0000:0000:000a,2602:fb54:0143:0000:0000:0000:0000:0099,2602:fb9f:0000:0000:0000:dead:beef:cafe,2602:fc24:0012:81a6:0000:0000:0000:0001,2602:fc24:0012:a34f:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 400"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522399; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2602:fc24:0019:0030:0000:0000:0000:0001,2602:fc24:0019:02b4:0000:0000:0000:0001,2602:fc24:0019:5286:0000:0000:0000:0001,2602:fc24:0019:95b7:0000:0000:0000:0001,2602:fc24:0019:eb06:0000:0000:0000:0001,2602:fc2f:0100:da00:0000:0000:0000:000a,2602:fc2f:0f00:0500:0000:0000:0000:000a,2602:fc81:0001:0001:0000:0000:0009:a600,2602:fcc0:2222:0000:80bb:15f6:4c3b:0001,2602:fccf:0310:0001:0000:0000:0000:000a] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 401"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522400; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2602:fccf:0310:0001:0000:0000:0000:000b,2602:fea7:0010:0000:8000:0000:0000:00b8,2602:fea7:0e0c:0013:0000:0000:0000:0007,2602:fed2:7314:0029:0000:0000:0000:000a,2602:fef9:0100:1100:0000:0000:0000:0199,2602:ff16:0006:0000:0001:0297:0000:0001,2602:ffc8:0001:0007:0000:0000:0000:0bad,2602:ffd5:0001:0174:3123:9092:3f1a:19c2,2602:ffd5:0001:028c:0000:0000:0000:0001,2602:ffd5:0001:029a:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 402"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522401; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2602:ffd5:0001:029b:0000:0000:0000:0001,2602:ffd5:0001:029c:0000:0000:0000:0001,2603:0003:6106:2460:0000:0000:0000:0000,2603:0003:610a:5050:0000:0000:0000:0000,2603:300a:1e09:2100:92b1:1cff:fe89:bc8f,2603:400a:0000:0009:f816:3eff:fe73:f862,2603:8000:0b00:aa00:0000:0000:0000:0080,2603:c020:000d:7862:a9f8:44ad:99d5:dbeb,2603:c020:4010:3301:57f6:7f0f:82bb:c569,2603:c020:4010:467e:26a5:c200:1675:190e] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 403"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522402; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2603:c020:4013:7201:1343:c2de:2cdc:06d1,2603:c020:4015:8e40:e591:8a6e:e510:2b9b,2603:c020:8000:6a00:0001:0000:0000:0001,2603:c020:8000:6a00:0002:0000:0000:0001,2603:c020:8002:5100:4d56:ebac:3c5d:a65b,2603:c020:8004:697e:7d01:d223:c6c6:b41c,2603:c020:8009:db88:89da:a27e:b299:c04e,2603:c020:800c:a63f:5b40:4174:3660:7f78,2603:c020:800c:c97e:6fa8:975b:b46a:bf36,2603:c020:800c:f2ff:f207:dfc9:702d:4613] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 404"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522403; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2603:c020:800d:8bff:6613:6cb5:af30:8bd5,2603:c020:800e:7a7e:0d86:3260:da4b:eedb,2603:c020:800e:7a7e:122d:c8f9:8bd2:ae9b,2603:c020:8012:8b01:a3a8:9024:985b:091e,2603:c020:8012:8b01:afef:180d:1d92:d3d4,2603:c020:8015:3900:0000:0000:0000:0022,2603:c020:8015:3900:0000:0000:0000:0023,2603:c020:8015:3900:0000:0000:0000:0024,2603:c020:8015:3900:0000:0000:0000:0025,2603:c020:c007:0cab:5235:002d:534b:0031] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 405"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522404; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2603:c020:c007:81ff:9c25:39c6:1dd3:33fc,2603:c020:c008:fcff:36e7:a1ec:cc48:42d7,2603:c021:4000:57de:153b:7aac:10d9:3f40,2603:c021:c003:3511:0001:0000:0000:0000,2603:c022:0002:97ff:ea23:6cb6:a969:ff7f,2603:c022:0004:f301:5c08:1f3f:725e:8a1c,2603:c022:8004:7800:d4aa:2e00:b389:6533,2603:c022:800a:8c8c:288d:f3a3:fe47:f4da,2603:c022:c001:6801:841d:34be:e33a:cf15,2603:c022:c001:6eff:4be1:c987:015c:da63] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 406"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522405; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2603:c022:c002:0b0e:df68:94b3:52b1:5f2c,2603:c022:c002:0b0e:f620:461d:1cc1:fa75,2603:c022:c003:1e01:5423:7a58:07b5:def4,2603:c022:c004:c4ff:a1dc:af91:6b4f:994b,2603:c022:c005:64a7:4aa9:f428:9dfc:08e0,2603:c023:4003:7f43:6162:6161:6c54:6f72,2603:c024:0001:f088:0034:0000:0000:0000,2603:c024:c001:207e:2b71:7031:c7c7:abec,2603:c024:c001:207e:878b:2a1b:d247:f367,2603:c024:c00b:9131:c6a2:f3c3:d086:c8b8] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 407"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522406; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2603:c026:0302:9bff:4ff5:b59d:9ff2:7eb7,2603:c026:0302:caff:9dae:2113:5e9b:415a,2603:c026:0303:22ff:83fa:fb0d:839e:a588,2603:c027:0000:caff:8058:d9b8:1072:cc10,2603:c027:8701:3d9f:228d:8ce5:bc20:5b67,2603:c027:8702:41ff:1df6:d9cd:dac9:2f86,2603:c027:8702:6dff:3bdf:efe8:3cdd:0cb6,2603:c027:c001:00ff:149e:4a2e:521f:de55,2603:c027:c001:24ff:21d1:e097:3099:6f57,2603:c027:c001:b4ff:b6cd:ec14:b49c:307b] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 408"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522407; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:2dc0:0100:04d6:0000:0000:0000:0000,2604:2dc0:0100:1286:0000:0000:0000:0001,2604:2dc0:0100:38e9:0000:0000:0000:0000,2604:2dc0:0101:0200:0000:0000:0000:006c,2604:2dc0:0101:0200:0000:0000:0000:02d6,2604:2dc0:0101:0200:0000:0000:0000:04e1,2604:2dc0:0101:0200:0000:0000:0000:0b63,2604:2dc0:0101:0200:0000:0000:0000:0c25,2604:2dc0:0101:0200:0000:0000:0000:1b3f,2604:2dc0:0101:0200:0000:0000:0000:1f45] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 409"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522408; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:2dc0:0101:0200:0000:0000:0000:3002,2604:2dc0:0101:0200:0000:0000:0000:36df,2604:2dc0:0101:0200:0000:0000:0000:36e0,2604:2dc0:0200:120b:0000:0000:0000:0042,2604:2dc0:0202:0300:0000:0000:0000:0013,2604:2dc0:0202:0300:0000:0000:0000:001f,2604:2dc0:0202:0300:0000:0000:0000:040e,2604:2dc0:0202:0300:0000:0000:0000:0581,2604:2dc0:0202:0300:0000:0000:0000:0995,2604:2dc0:0202:0300:0000:0000:0000:0a02] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 410"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522409; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:2dc0:0202:0300:0000:0000:0000:0cd0,2604:2dc0:0202:0300:0000:0000:0000:0ed3,2604:2dc0:0202:0300:0000:0000:0000:140d,2604:3d09:667c:9560:0000:0000:0000:0009,2604:4300:000a:0134:0000:0000:dead:beef,2604:4300:000a:03bc:0224:1dff:fe70:b203,2604:4300:000a:03e9:0000:0000:0000:0170,2604:4500:0006:0026:1c00:48ff:fe00:0117,2604:4500:0008:0014:0000:0000:0000:0004,2604:4500:0008:0014:0000:0000:0000:0008] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 411"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522410; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:4500:0009:003d:1c00:f8ff:fe00:0307,2604:5040:0011:0128:f0c1:922b:4103:d4c6,2604:6600:0000:0042:0000:0000:0000:0002,2604:86c0:f001:000d:03fb:9cdb:e984:ebbe,2604:86c0:f001:000d:0baf:37c2:e99f:c001,2604:86c0:f001:000d:0fda:37c6:e9ee:d00f,2604:86c0:f001:000d:1bac:b7c2:ea9e:0101,2604:86c0:f001:000d:33fe:098a:2984:b1b1,2604:86c0:f001:000d:4973:1939:028c:b0b0,2604:86c0:f001:000d:4bae:0a72:779e:affe] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 412"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522411; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:86c0:f001:000d:4cad:0202:79ba:1dea,2604:86c0:f001:000d:4cad:0202:79ba:abcd,2604:86c0:f001:000d:5555:0404:b544:1234,2604:86c0:f001:000d:8aab:0f9a:8771:d00d,2604:86c0:f001:000d:9bab:31c2:099b:babe,2604:86c0:f001:000d:9bad:34c2:089e:1d01,2604:86c0:f001:000d:9bcf:0752:ec9e:abba,2604:86c0:f001:000d:ba11:90a5:0d61:d0ed,2604:86c0:f001:000d:ba11:90a5:0d61:ede1,2604:86c0:f001:000d:ccaa:07c2:c9ce:f001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 413"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522412; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:86c0:f001:000d:dd01:0988:7164:f1ee,2604:86c0:f001:000d:fbab:47c2:0ebb:c0de,2604:86c0:f001:000d:fcfc:0681:aa64:feed,2604:a880:0001:0020:0000:0000:003b:1001,2604:a880:0002:00d0:0000:0000:0045:e001,2604:a880:0002:00d0:0000:0000:134f:c001,2604:a880:0002:00d0:0000:0000:14bc:7001,2604:a880:0002:00d0:0000:0000:14cd:f001,2604:a880:0002:00d0:0000:0000:218c:1001,2604:a880:0002:00d0:0000:0000:23c6:2001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 414"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522413; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:a880:0004:01d0:0000:0000:008a:0000,2604:a880:0004:01d0:0000:0000:00a3:5000,2604:a880:0004:01d0:0000:0000:0141:e000,2604:a880:0004:01d0:0000:0000:01fb:5000,2604:a880:0004:01d0:0000:0000:042a:9000,2604:a880:0400:00d0:0000:0000:0026:a001,2604:a880:0400:00d0:0000:0000:026a:b001,2604:a880:0400:00d0:0000:0000:12bc:9001,2604:a880:0400:00d0:0000:0000:1300:4001,2604:a880:0400:00d0:0000:0000:1516:c001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 415"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522414; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:a880:0400:00d0:0000:0000:237f:f001,2604:a880:0800:0010:0000:0000:0104:9001,2604:a880:0800:0010:0000:0000:05c5:3001,2604:a880:0800:0010:0000:0000:069d:d001,2604:a880:0800:0010:0000:0000:070b:8001,2604:a880:0800:0010:0000:0000:0730:b001,2604:a880:0800:0010:0000:0000:231b:c001,2604:a880:0cad:00d0:0000:0000:09e3:9001,2604:a880:0cad:00d0:0000:0000:6805:f001,2604:b480:0003:0006:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 416"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522415; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2604:d180:0041:0000:0000:0000:7b39:4456,2605:2700:0000:0002:a800:00ff:fe39:0574,2605:2700:0000:0002:a800:00ff:fea5:86a7,2605:2700:0000:0002:a800:00ff:feef:b488,2605:2700:0000:0003:a800:00ff:fe10:f0d3,2605:2700:0000:0005:a800:00ff:fe13:9cab,2605:2700:0001:1008:bdcf:70a4:ad52:f4e8,2605:6400:0010:0075:1585:9b71:1c16:b1a1,2605:6400:0010:0123:88e2:97f2:bfaf:1ea6,2605:6400:0010:012b:1877:e308:72b3:41b0] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 417"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522416; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0010:016e:e9da:a184:bfe1:e727,2605:6400:0010:01ab:2605:6400:0010:01ab,2605:6400:0010:03f9:116c:94a1:a862:dfec,2605:6400:0010:03f9:2fb4:3d9c:a1bc:73a3,2605:6400:0010:03f9:42af:65de:583f:49f1,2605:6400:0010:03f9:8fca:7115:49b6:57fd,2605:6400:0010:03f9:b9ce:43e8:7a59:6f17,2605:6400:0010:03f9:bf6e:ca88:3193:7de8,2605:6400:0010:03f9:c161:156a:847d:1a1d,2605:6400:0010:03f9:f741:57f7:8f88:b2bd] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 418"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522417; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0010:044f:0000:0000:0000:0001,2605:6400:0010:04b0:0000:0000:0000:0001,2605:6400:0010:04ed:0001:0001:0001:0001,2605:6400:0010:058f:8768:8283:1a62:bdc6,2605:6400:0010:0797:4638:253c:c3f1:cc4a,2605:6400:0010:08a2:de49:ffd1:46f5:99a2,2605:6400:0010:0984:41e7:4ad6:a11e:cdcc,2605:6400:0010:0aa1:2db8:1c14:2191:4aa8,2605:6400:0010:0c39:3b1c:a9d9:fb78:d7f1,2605:6400:0010:1008:1111:1111:1111:1111] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 419"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522418; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0010:1060:411f:41d8:11fe:716f,2605:6400:0010:1362:0000:0000:0000:0002,2605:6400:0020:01a8:f5f2:4a28:b5ed:931d,2605:6400:0020:0274:0000:0000:0000:0001,2605:6400:0020:03ea:c2a3:1162:7224:e5df,2605:6400:0020:0482:3920:1829:1839:1293,2605:6400:0020:0ae6:e6c6:0d90:fee8:5ad5,2605:6400:0020:0be7:0000:0000:0000:0001,2605:6400:0020:0ff9:0000:0000:0000:0001,2605:6400:0020:104e:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 420"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522419; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0020:121a:0346:8344:0f07:7a35,2605:6400:0020:19cb:dd92:af73:5b09:3e0a,2605:6400:0020:1c01:7d33:a5db:c2b9:1092,2605:6400:0020:2417:0000:0000:0000:0069,2605:6400:0030:e88d:36fc:7ca1:dff5:1e57,2605:6400:0030:e948:4cee:191b:1e55:25b3,2605:6400:0030:ea52:4246:fb82:f36c:8ede,2605:6400:0030:ea58:51a1:e174:d185:d6f1,2605:6400:0030:ea86:59b6:d4c6:5192:1a19,2605:6400:0030:eb71:51b7:4869:7579:3aa1] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 421"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522420; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:ebb6:0532:0acc:0065:0031,2605:6400:0030:ed0c:b477:4972:756a:2f42,2605:6400:0030:ed65:a5f1:548c:47c3:6185,2605:6400:0030:edc3:0000:0000:0000:0034,2605:6400:0030:ef7a:391a:8c71:a2f1:9506,2605:6400:0030:ef95:daa6:bd3c:c413:da7e,2605:6400:0030:efb2:0000:0000:0000:0000,2605:6400:0030:efba:dead:0000:0000:0000,2605:6400:0030:efe6:1313:cafe:dead:beef,2605:6400:0030:f08c:45b7:4a99:a154:694e] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 422"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522421; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:f0ed:9151:66ed:6366:5c74,2605:6400:0030:f174:0000:0000:0000:0000,2605:6400:0030:f174:0000:0000:0000:0042,2605:6400:0030:f174:0001:0001:0001:0001,2605:6400:0030:f174:0001:0002:0003:0004,2605:6400:0030:f174:0004:0003:0002:0001,2605:6400:0030:f174:0042:0042:0000:0000,2605:6400:0030:f174:0042:0042:0042:0000,2605:6400:0030:f174:0042:0042:0042:0042,2605:6400:0030:f174:1111:2222:3333:4444] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 423"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522422; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:f174:cafe:0000:0000:0000,2605:6400:0030:f1fa:f57f:d285:3ed9:ee27,2605:6400:0030:f307:1712:1a11:9b1c:ab7f,2605:6400:0030:f307:3aa6:91d4:da12:7eee,2605:6400:0030:f307:5d12:16d8:1641:2b15,2605:6400:0030:f307:ba73:e934:5195:accd,2605:6400:0030:f307:c2bf:d371:75a9:31e6,2605:6400:0030:f307:ff42:3928:c777:8563,2605:6400:0030:f32b:7417:ea33:425b:9732,2605:6400:0030:f32b:8fec:4251:d9d1:1ff5] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 424"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522423; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:f32b:c191:e73e:8bd5:9c61,2605:6400:0030:f330:61ea:72a8:8aea:fa1f,2605:6400:0030:f38b:28b3:cd24:51f3:e412,2605:6400:0030:f414:42ce:c612:dab8:1337,2605:6400:0030:f440:757e:adf1:55f7:5a31,2605:6400:0030:f49b:e2ee:34f8:c854:6f63,2605:6400:0030:f4ae:8f7b:cc6e:d1d7:b978,2605:6400:0030:f503:0000:0000:0000:0001,2605:6400:0030:f51a:f826:ecfc:47b6:92a9,2605:6400:0030:f534:ae1d:c3d9:9941:d85e] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 425"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522424; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:f57d:916e:73f8:d5e7:675b,2605:6400:0030:f5a3:5bb1:af4e:c969:c73e,2605:6400:0030:f5db:25a1:b884:ef2d:8818,2605:6400:0030:f623:5a78:29a6:8492:27b0,2605:6400:0030:f671:3fc7:4bb4:ca18:86fa,2605:6400:0030:f6b7:0000:0000:0000:1337,2605:6400:0030:f753:891d:ee77:e97c:741a,2605:6400:0030:f763:0000:0000:0000:0002,2605:6400:0030:f789:e82c:c670:578c:b588,2605:6400:0030:f78b:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 426"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522425; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:f7c0:8511:b113:ca11:9baa,2605:6400:0030:f7ca:0000:0000:0000:0002,2605:6400:0030:f7fa:c230:6fe8:a09a:5836,2605:6400:0030:f805:1e96:b223:fbe5:cfac,2605:6400:0030:f82f:7de1:3de3:8947:bc6a,2605:6400:0030:f858:2704:73e1:7085:12ef,2605:6400:0030:f8b5:620c:dc25:c624:aafd,2605:6400:0030:f8d5:0000:0000:0000:0001,2605:6400:0030:f8da:02b2:a293:30ad:506d,2605:6400:0030:f8f5:20c6:dcb6:3c07:1c9e] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 427"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522426; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:0030:f920:f523:28ef:3617:8b86,2605:6400:0030:f986:f96a:3b4d:e117:2050,2605:6400:0030:f99f:0000:0000:0000:0001,2605:6400:0030:f9d0:8d45:cd51:c1aa:271f,2605:6400:0030:fb10:d07b:edfd:2c84:bb4a,2605:6400:0030:fb5a:0000:0000:0000:0001,2605:6400:0040:fde8:11c7:119b:aaf9:2722,2605:6400:0040:fe09:0000:0000:0000:0002,2605:6400:0040:fe95:b91a:eae5:66fe:996a,2605:6400:d814:01b8:0000:0000:0000:0004] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 428"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522427; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2605:6400:d814:34f4:0000:0000:0000:0005,2605:6400:d814:3d5c:0000:0000:0000:0001,2605:6400:d814:b9da:0000:0000:0000:0000,2605:9f80:2000:0083:0000:0000:0000:0002,2605:a140:2186:5418:0000:0000:0000:0001,2605:aa80:0000:0009:0000:0000:0000:0003,2605:aa80:c007:1736:0000:0000:0000:0000,2605:e440:0003:0000:0000:0000:0000:03f4,2606:00c0:0002:004c:0000:0000:0000:000f,2606:00c0:0002:0080:0000:0000:0000:be32] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 429"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522428; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2606:65c0:0020:0017:d747:b17f:e95c:6374,2606:6d00:01ab:e701:0000:0000:0000:235a,2606:a8c0:0003:0000:0000:0000:0000:04d9,2606:a8c0:0003:0100:0000:0000:0000:000a,2606:a8c0:0003:0135:0000:0000:0000:000a,2606:a8c0:0003:02bf:0000:0000:0000:000a,2606:a8c0:0003:02d4:0000:0000:0000:000a,2606:a8c0:0003:04e3:0000:0000:0000:000a,2606:a8c0:0003:0761:0000:0000:0000:000a,2606:a8c0:0101:00ad:0000:0000:0000:000a] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 430"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522429; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2606:a8c0:0101:00b4:0000:0000:0000:000a,2607:5300:0061:0785:0000:0000:0000:0000,2607:5300:0061:0785:0001:0002:0003:0004,2607:5300:0201:3000:0000:0000:0000:0da8,2607:5300:0201:3000:0000:0000:0000:0dfc,2607:5300:0201:3000:0000:0000:0000:17d3,2607:5300:0201:3100:0000:0000:0000:143f,2607:5300:0201:3100:0000:0000:0000:348e,2607:5300:0201:3100:0000:0000:0000:3aef,2607:5300:0201:3100:0000:0000:0000:3e59] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 431"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522430; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2607:5300:0201:3100:0000:0000:0000:465b,2607:5300:0201:3100:0000:0000:0000:4a8e,2607:5300:0201:3100:0000:0000:0000:535e,2607:5300:0201:3100:0000:0000:0000:5b0d,2607:5300:0201:3100:0000:0000:0000:84f6,2607:5300:0203:06e5:0000:0000:0000:0046,2607:5300:0203:7ac5:0198:0050:0223:0016,2607:5300:0205:0200:0000:0000:0000:0938,2607:5300:0205:0200:0000:0000:0000:105c,2607:5300:0205:0200:0000:0000:0000:163a] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 432"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522431; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2607:5300:0205:0200:0000:0000:0000:1d62,2607:5300:0205:0200:0000:0000:0000:1f8d,2607:5300:0205:0200:0000:0000:0000:1fb3,2607:5300:0205:0200:0000:0000:0000:2e81,2607:5300:0205:0200:0000:0000:0000:4894,2607:5600:00c6:0226:0000:0000:0000:0001,2607:9000:0000:0028:0000:0000:2610:75dc,2607:b500:0424:a800:0000:0000:0000:0001,2607:b500:0425:9100:0000:0000:0000:0001,2607:b500:042f:af00:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 433"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522432; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2607:b500:0430:8d00:0000:0000:0000:0001,2607:f130:0000:00ed:0216:3cff:feb7:f453,2607:f130:0000:00ee:0000:0000:347e:2640,2607:f130:0000:0105:00ff:00ff:5c5e:6ac1,2607:f1c0:f00b:ca00:0000:0000:0000:0001,2607:f1c0:f00f:d300:0000:0000:0000:0001,2607:f298:0005:101d:f816:3eff:fe56:6ffa,2607:f298:0005:101d:f816:3eff:fe9b:c835,2607:f298:0005:101d:f816:3eff:fe9f:47b1,2607:f298:0005:101d:f816:3eff:fea3:00b8] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 434"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522433; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2607:f298:0005:101d:f816:3eff:fefd:ad20,2607:f2c0:f00e:0300:0000:0000:0000:0054,2607:f2c0:f200:0b02:64bc:b0eb:40ab:6573,2607:f530:8002:0000:0000:0000:0000:0019,2610:01c0:0000:0005:0000:0000:0000:0016,2610:01c0:0000:0005:0000:0000:0000:0020,2610:01c0:0000:0005:0000:0000:0000:0131,2620:0006:2000:0104:0000:0000:0000:000a,2620:0007:6001:0000:0000:0000:0000:0184,2620:0007:6001:0000:0000:0000:0000:0185] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 435"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522434; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2620:0007:6001:0000:0000:0000:0000:0186,2620:0007:6001:0000:0000:0000:0000:0187,2620:0007:6001:0000:0000:0000:0000:0188,2620:0013:4000:6000:0000:0000:1000:0118,2620:00b0:2000:0102:0000:0000:0000:0007,2620:0124:1009:0001:0000:0000:0000:0171,2800:0ba0:0006:00c1:0000:0000:0000:4858,2804:5364:7000:0001:0001:0001:9a5d:64ec,2806:106e:0019:812c:02ca:5aff:fe00:0002,2806:10a6:0026:ee29:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 436"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522435; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:0c70:0130:0001:0000:0000:0000:0506,2a00:0c70:0130:0001:0000:0000:0000:0529,2a00:0c90:0000:0000:0000:0000:0056:0002,2a00:1158:0002:cd00:0000:0074:006f:0072,2a00:1158:0003:0000:0000:0000:0000:01ba,2a00:1158:0003:0000:0000:0000:0000:02ae,2a00:1169:0112:5df0:0000:0000:0000:0000,2a00:1169:0114:28c0:0000:0000:0000:0000,2a00:1169:0119:b120:0000:0000:0000:0000,2a00:1169:011c:3e00:0000:0000:0000:0000] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 437"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522436; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:1169:011f:d680:0000:0000:0000:0000,2a00:11c0:001c:0311:0000:0000:0000:0005,2a00:11c0:001f:0001:0000:0000:0000:0055,2a00:11c0:0060:02cf:d8b5:30ff:fe27:f208,2a00:1210:0000:00fe:0000:0000:0028:1856,2a00:1398:0005:f604:cafe:cafe:cafe:9001,2a00:1520:0027:0001:af00:6910:ebff:7f35,2a00:1728:000f:000f:000f:000f:c03c:9898,2a00:1728:003f:0000:0000:0000:c0cc:0069,2a00:1728:003f:0000:0000:0000:c0cc:006c] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 438"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522437; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:1838:0035:0100:0000:0000:0000:e928,2a00:1838:0036:0029:0000:0000:0000:9001,2a00:1838:0036:0029:0000:0000:0000:9201,2a00:1838:0036:0115:0000:0000:0000:8a3d,2a00:1838:0037:0052:0000:0000:0000:da4e,2a00:1838:0037:0380:0000:0000:0000:57da,2a00:1838:0037:0468:0000:0000:0000:98b4,2a00:1911:0001:4de6:5084:ef85:6fab:4b4b,2a00:19a0:0003:00d0:0000:252e:d071:0001,2a00:1b88:0004:0000:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 439"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522438; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:1b88:0004:0000:0000:0000:0000:0004,2a00:1ca8:002a:0033:0000:0000:0000:0002,2a00:1dc0:caff:0015:0000:0000:0000:45dc,2a00:1dc0:caff:0017:0000:0000:0000:e352,2a00:1dc0:caff:0020:0000:0000:0000:eda9,2a00:1dc0:caff:0073:0000:0000:0000:a568,2a00:1dc0:caff:008b:0000:0000:0000:24bd,2a00:1dc0:caff:00b8:0000:0000:0000:6b9c,2a00:1dc0:caff:0118:0000:0000:0000:a2d7,2a00:1dc0:caff:0126:0000:0000:0000:a5c9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 440"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522439; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:1dc0:caff:0138:0000:0000:0000:94d2,2a00:1dc0:caff:0172:0000:0000:0000:635a,2a00:1dc0:caff:0178:0000:0000:0000:982b,2a00:23c5:ed96:1501:96c6:91ff:feaf:83a7,2a00:23c6:6284:2400:8c0e:76ff:fe5d:cddf,2a00:4d80:0000:0000:0000:0000:0000:0001,2a00:6020:b2c5:d8cc:bbbb:bad4:5326:3d78,2a00:63c1:000c:0014:0000:0000:0000:0002,2a00:63c1:0010:0004:0000:0000:c001:c0de,2a00:63c1:0010:0041:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 441"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522440; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:63c1:0013:0148:0000:0000:0000:0002,2a00:63c1:0013:0229:fa53:5051:8c88:ff1e,2a00:6800:0003:023b:7777:7777:7777:7777,2a00:6800:0003:02c8:0000:0000:0000:0001,2a00:6800:0003:02ef:0000:0000:0000:0001,2a00:6800:0003:0415:0000:0000:0000:0001,2a00:6800:0003:074b:0000:0000:0000:1111,2a00:6800:0003:085b:0000:0000:0000:0001,2a00:6800:0003:092c:0000:0000:0000:0001,2a00:6800:0003:0bb5:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 442"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522441; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:6800:0003:0bc0:0000:0000:0000:0003,2a00:6800:0003:0c0b:0000:0000:0000:0000,2a00:6800:0003:0c57:0000:0000:0000:0000,2a00:6800:0003:0c8d:0000:0000:0000:0000,2a00:6800:0003:0cc5:0000:0000:0000:0003,2a00:6d40:0072:2bf1:0000:0000:0000:0001,2a00:6d40:0072:adad:0000:0000:0000:0001,2a00:6d41:0200:0002:0000:0000:0000:00e7,2a00:7fc0:8001:0002:0000:0000:0000:0007,2a00:8780:0014:2000:0000:0000:0000:0003] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 443"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522442; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:8a60:e012:0a00:0000:0000:0000:0021,2a00:8dc0:aa00:0000:0000:0000:0000:0019,2a00:99a0:0000:1000:0000:0000:0000:0002,2a00:ab00:0435:000a:dead:defe:ca8d:beef,2a00:b700:0000:0000:0000:0000:0000:00f9,2a00:b700:0000:0000:0000:0000:0000:02ab,2a00:b700:0004:0000:0000:0000:0000:00c9,2a00:b700:0004:0000:0000:0000:0000:0366,2a00:b700:0004:0000:0000:0000:0000:03ab,2a00:bd80:0012:0000:0000:0000:0000:000f] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 444"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522443; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:c6c0:0000:0154:0005:0000:0000:0010,2a00:d0c0:0200:0000:00b9:001a:009c:008c,2a00:d4e0:00ff:fc02:9e6b:00ff:fe17:6115,2a00:d880:0011:0000:0000:0000:0000:010b,2a00:da00:1800:0257:0000:0000:0000:0001,2a00:da00:1800:81b9:0000:0000:0000:0001,2a00:da00:1800:82ac:0000:0000:0000:0001,2a00:da00:1800:832b:0000:0000:0000:0001,2a00:da00:1800:8344:0000:0000:0000:0001,2a00:da00:f212:c300:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 445"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522444; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a00:dcc0:0eda:0088:0245:0071:1b13:d10f,2a00:dcc0:dead:b2e0:0000:0000:0000:0001,2a00:e140:0000:0000:0000:0000:0000:0034,2a01:00d0:fc27:0000:dea6:32ff:fe44:be84,2a01:0191:0000:0000:0000:0000:0000:0000,2a01:0238:4224:8d00:f3a9:25e6:4cb6:0f3d,2a01:0238:424c:1900:a87e:0747:8f75:a70e,2a01:0238:4273:fd00:e5ca:9f03:dfca:9a71,2a01:0238:4297:d000:38ef:8986:0937:872a,2a01:0238:429c:9600:40e6:e961:9cf7:31d1] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 446"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522445; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:0238:42e7:b400:778d:ed2d:68b5:acaa,2a01:0238:4302:6600:1757:cf19:ce3d:23a0,2a01:0238:430f:0600:5628:8879:3e0c:7547,2a01:0238:4326:f500:05f9:1474:1f7b:814a,2a01:0238:439a:1900:43d6:a3e4:9968:9811,2a01:0238:43de:1a00:7fbf:f902:d7a7:4f2c,2a01:0239:0227:1b00:0000:0000:0000:0001,2a01:0239:0229:d300:0000:0000:0000:0001,2a01:0239:022d:d800:0000:0000:0000:0001,2a01:0239:0249:f100:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 447"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522446; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:0239:0254:8c00:0000:0000:0000:0001,2a01:0239:026f:8b00:0000:0000:0000:0001,2a01:0239:0277:5800:0000:0000:0000:0001,2a01:0239:0298:3f00:0000:0000:0000:0001,2a01:0239:029d:7100:0000:0000:0000:0001,2a01:0239:02b2:4600:0000:0000:0000:0002,2a01:0239:02bd:c200:0000:0000:0000:0001,2a01:0239:02d2:3900:0000:0000:0000:0001,2a01:0239:02e3:e000:0000:0000:0000:0001,2a01:0270:9293:0000:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 448"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522447; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:0348:0070:0046:0017:0063:0214:0001,2a01:0440:0108:0011:0082:0149:0227:0123,2a01:0440:0108:0011:0082:0149:0227:0124,2a01:0440:0108:0011:0082:0149:0227:0125,2a01:0440:0108:0011:0082:0149:0227:0126,2a01:0488:0066:1000:2ea3:4caa:0000:0001,2a01:0488:0067:1000:5bfa:5134:0000:0001,2a01:04a0:0072:001a:0000:0000:0000:2579,2a01:04f8:00a0:2276:0001:0000:0000:0020,2a01:04f8:00a0:8070:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 449"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522448; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:00a0:8447:0000:0000:0000:0002,2a01:04f8:00a0:90b0:789d:06a4:95f3:a78c,2a01:04f8:00d1:3aa6:0250:56ff:feb7:4e0f,2a01:04f8:010a:189f:0000:0000:0000:0002,2a01:04f8:010a:1f06:0000:0000:0000:0002,2a01:04f8:010a:292a:0000:0000:0000:0002,2a01:04f8:010a:295e:0000:0000:0000:0002,2a01:04f8:010b:0670:0000:0000:0000:0002,2a01:04f8:010b:0f04:0000:0000:0000:0002,2a01:04f8:010b:2952:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 450"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522449; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:010b:3357:0000:0000:0000:0002,2a01:04f8:010b:3702:0000:0000:0000:0002,2a01:04f8:0120:205b:0000:0000:0000:0002,2a01:04f8:0120:4169:0000:0000:0000:0002,2a01:04f8:0120:7335:0000:0000:0002:9001,2a01:04f8:0121:12b3:0000:0000:0000:0002,2a01:04f8:013a:1fa3:0000:0000:0000:0002,2a01:04f8:013a:2291:0000:0000:0000:0002,2a01:04f8:013b:03e8:0195:0201:0062:0078,2a01:04f8:013b:2dab:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 451"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522450; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:013b:3ad0:0001:0000:0000:0003,2a01:04f8:0140:1465:0000:0000:0000:0002,2a01:04f8:0140:244f:0000:0000:0000:0002,2a01:04f8:0140:2459:0000:0000:0000:0002,2a01:04f8:0140:5486:0000:0000:0000:0002,2a01:04f8:0140:8229:0000:0000:0000:0002,2a01:04f8:0140:94d6:0000:0000:0000:0002,2a01:04f8:0141:0282:0000:0000:0000:0003,2a01:04f8:0141:030f:0000:0000:0000:0002,2a01:04f8:0141:030f:0000:0000:0000:0003] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 452"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522451; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0141:030f:0000:0000:0000:0004,2a01:04f8:0141:4281:0000:0000:0003:fee6,2a01:04f8:0150:210c:0001:0000:0000:0020,2a01:04f8:0150:508a:a62c:0457:6b0c:a1f9,2a01:04f8:0150:72dd:0103:9f83:cb31:7fd1,2a01:04f8:0150:81d4:0000:0000:0000:0002,2a01:04f8:0151:2324:0000:0000:0000:0002,2a01:04f8:0151:3124:0bad:0c47:0000:0503,2a01:04f8:0160:83c4:0000:0000:0000:0003,2a01:04f8:0160:8410:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 453"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522452; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0160:8410:0000:0000:0000:0003,2a01:04f8:0161:0391:0006:0000:0000:0002,2a01:04f8:0161:353a:0000:0000:0000:0002,2a01:04f8:0161:52cb:0000:0000:0000:0002,2a01:04f8:0161:7148:0000:0000:0000:0002,2a01:04f8:0161:93f2:0000:0000:0000:0002,2a01:04f8:0162:72e9:aaaa:bbbb:4242:0253,2a01:04f8:0171:0501:0000:0000:0000:0002,2a01:04f8:0171:15ef:0000:0000:0000:0002,2a01:04f8:0171:1cd2:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 454"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522453; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0171:238c:0000:0000:0000:0002,2a01:04f8:0171:28e9:0000:0000:0000:0002,2a01:04f8:0172:0cad:0000:0000:0000:0002,2a01:04f8:0172:12e6:0000:0000:0000:0002,2a01:04f8:0172:1317:0000:0000:0000:0002,2a01:04f8:0172:34d5:0000:0000:0000:0002,2a01:04f8:0172:3e99:0000:0000:0000:0002,2a01:04f8:0173:12d6:0000:0000:0000:0002,2a01:04f8:0173:1d2e:0000:0000:0000:0002,2a01:04f8:0173:2953:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 455"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522454; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0190:62d9:0000:0000:0000:0002,2a01:04f8:0190:7385:0000:0000:0000:0002,2a01:04f8:0190:73a4:0000:0000:0000:0002,2a01:04f8:0191:602a:0000:0000:0000:0002,2a01:04f8:0192:03c5:0000:0000:0000:0002,2a01:04f8:0192:1318:0000:0000:0000:0002,2a01:04f8:0200:2211:0000:0000:0000:0002,2a01:04f8:0200:32e6:0000:0000:0000:0002,2a01:04f8:0200:3391:0000:0000:0000:0002,2a01:04f8:0200:428c:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 456"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522455; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0200:42c6:0000:0000:0000:0002,2a01:04f8:0200:4423:0000:0000:0000:0002,2a01:04f8:0200:82ca:0000:0000:0000:0002,2a01:04f8:0201:34d0:0000:0000:0000:0002,2a01:04f8:0201:44d3:0000:0000:0000:0002,2a01:04f8:0201:922f:0000:0000:0000:0001,2a01:04f8:0202:0172:0000:0000:0000:0002,2a01:04f8:0202:1139:0000:0000:0000:0002,2a01:04f8:0202:5368:0000:0000:0000:0002,2a01:04f8:0202:6096:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 457"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522456; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0202:7071:0000:0000:0000:0002,2a01:04f8:0202:7144:c49d:e29a:d44a:c6ea,2a01:04f8:0210:2073:0000:0000:0000:0000,2a01:04f8:0210:400f:0000:0000:0000:0002,2a01:04f8:0210:504b:0000:0000:0000:0003,2a01:04f8:0211:00cc:0000:0000:0000:0002,2a01:04f8:0211:1d41:0000:0000:0000:0002,2a01:04f8:0212:1b8b:0003:0000:0000:0008,2a01:04f8:0221:0b52:fcfd:00ff:fe00:ec09,2a01:04f8:0221:1ac1:dead:beef:7005:9001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 458"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522457; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0221:3641:0000:0000:0000:0003,2a01:04f8:0222:019a:0000:0000:0000:0003,2a01:04f8:0231:019f:0000:0000:0000:0002,2a01:04f8:0231:16e0:0000:0000:0000:0002,2a01:04f8:0231:1ed8:0106:0000:0000:0106,2a01:04f8:0231:4547:0000:0000:0000:0002,2a01:04f8:0241:4d16:0000:0000:0000:0002,2a01:04f8:0241:509e:0000:0000:0000:0002,2a01:04f8:0241:5781:0000:0000:0000:0002,2a01:04f8:0241:5781:0000:0000:0000:0003] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 459"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522458; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0241:5781:0000:0000:0000:0004,2a01:04f8:0241:5781:0000:0000:0000:0005,2a01:04f8:0241:5781:0000:0000:0000:0006,2a01:04f8:0241:5781:0000:0000:0000:f00f,2a01:04f8:0252:194b:0000:0000:0000:0002,2a01:04f8:0252:3df0:0000:0000:0000:0002,2a01:04f8:0252:4568:0009:0000:0000:0010,2a01:04f8:0261:27e5:0000:0000:0000:0002,2a01:04f8:0261:2ced:0000:0000:0000:0002,2a01:04f8:0261:50da:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 460"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522459; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0262:5106:0000:0000:0000:0002,2a01:04f8:0271:141c:0000:0000:0000:0002,2a01:04f8:0271:141c:0000:0000:0000:0004,2a01:04f8:0271:141c:0000:0000:0000:0005,2a01:04f8:0271:5d58:0000:0000:0000:0002,2a01:04f8:0c0c:358b:0000:0000:0000:0001,2a01:04f8:0c0c:3ef2:0000:0000:0000:0001,2a01:04f8:0c0c:6a57:0000:0000:0000:0001,2a01:04f8:0c0c:734d:0000:0000:0000:0001,2a01:04f8:0c0c:b436:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 461"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522460; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0c0c:b448:0000:0000:0000:0001,2a01:04f8:0c17:082b:0000:0000:0000:0002,2a01:04f8:0c17:0caf:0000:0000:0000:0001,2a01:04f8:0c17:49c0:0000:0000:0000:0001,2a01:04f8:0c17:71fa:0000:0000:0000:0001,2a01:04f8:0c17:ba99:0000:0000:0000:0001,2a01:04f8:0c17:cff9:0000:0000:0000:0001,2a01:04f8:0c17:e4d1:0000:0000:0000:0001,2a01:04f8:0c2c:0d75:0000:0000:0000:0001,2a01:04f8:0c2c:1fdf:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 462"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522461; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:0c2c:4cc5:0000:0000:0000:0001,2a01:04f8:0c2c:d4e4:0000:0000:0000:0001,2a01:04f8:0c2c:e8a0:0000:0000:0000:0001,2a01:04f8:0c2c:f266:0000:0000:0000:0001,2a01:04f8:0c2c:f4b0:0000:0000:0000:0001,2a01:04f8:1c0c:453a:0000:0000:0000:0001,2a01:04f8:1c0c:6c6b:0000:0000:0000:0001,2a01:04f8:1c0c:6f8c:0000:0000:0000:0002,2a01:04f8:1c0c:7fe9:0000:0000:0000:0001,2a01:04f8:1c17:5bf3:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 463"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522462; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:1c17:772f:0000:0000:0000:0001,2a01:04f8:1c17:b062:0000:0000:0000:0000,2a01:04f8:1c1b:59c0:0000:0000:0000:0001,2a01:04f8:1c1b:68eb:0000:0000:0000:0001,2a01:04f8:1c1b:7ec4:0000:0000:0000:0001,2a01:04f8:1c1c:078a:0000:0000:0000:0001,2a01:04f8:1c1c:2ca4:0000:0000:0000:0001,2a01:04f8:1c1c:2e49:0000:0000:0000:0001,2a01:04f8:1c1c:31b5:0000:0000:0000:0001,2a01:04f8:1c1c:425a:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 464"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522463; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:1c1c:67f3:0000:0000:0000:0001,2a01:04f8:1c1c:80f8:0000:0000:0000:0001,2a01:04f8:1c1c:9026:0000:0000:0000:0001,2a01:04f8:1c1c:b16b:0000:0000:0000:0001,2a01:04f8:1c1c:bba4:0000:0000:0000:0001,2a01:04f8:1c1e:5b38:0000:0000:0000:0001,2a01:04f8:1c1e:8405:0000:0000:0000:0001,2a01:04f8:1c1e:8a0f:0000:0000:0000:0001,2a01:04f8:1c1e:95be:0000:0000:0000:0001,2a01:04f8:1c1e:9e54:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 465"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522464; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:2200:14dc:0120:0000:0000:0100,2a01:04f8:2200:14dc:0120:0000:0000:0101,2a01:04f8:2200:40d4:0000:0000:0000:0002,2a01:04f8:2200:40d4:0000:0000:0000:0003,2a01:04f8:2200:40d4:0000:0000:0000:0004,2a01:04f8:2200:40d4:0000:0000:0000:0005,2a01:04f8:2200:40d4:0000:0000:0000:beef,2a01:04f8:c010:14cb:0000:0000:0000:0001,2a01:04f8:c010:86ae:0000:0000:0000:0001,2a01:04f8:c010:8c19:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 466"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522465; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:c010:bfb1:0000:0000:0000:0001,2a01:04f8:c012:3902:0000:0000:0000:0001,2a01:04f8:c012:7589:0000:0000:0000:0001,2a01:04f8:c012:8818:0000:0000:0000:0001,2a01:04f8:c012:a023:0000:0000:0000:0001,2a01:04f8:c012:a0d5:0000:0000:0000:0001,2a01:04f8:c012:c9bc:0000:0000:0000:0001,2a01:04f8:c012:f64b:0000:0000:0000:0001,2a01:04f8:c013:1024:0000:0000:0000:0001,2a01:04f8:c013:1836:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 467"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522466; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f8:fff0:004f:0266:37ff:fee5:cc35,2a01:04f9:001a:f510:0000:d0d0:0015:dead,2a01:04f9:002a:03d4:0000:0000:0000:0002,2a01:04f9:002a:0c5c:0000:0000:0000:0002,2a01:04f9:002a:0d54:0000:0000:0000:0002,2a01:04f9:002a:0d96:0000:0000:0000:0002,2a01:04f9:002a:134f:0000:0000:0000:0002,2a01:04f9:002a:14af:0000:0000:0000:0002,2a01:04f9:002a:164a:0000:0000:0000:0002,2a01:04f9:002a:1669:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 468"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522467; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:002a:16a8:0000:0000:0000:0002,2a01:04f9:002a:1787:0000:0999:0000:2086,2a01:04f9:002a:1b96:0002:0000:0000:0002,2a01:04f9:002a:204e:0000:0000:0000:0002,2a01:04f9:002a:2145:0000:0000:0000:0001,2a01:04f9:002a:2145:0000:0000:0000:0002,2a01:04f9:002b:08d8:0000:0000:0000:0002,2a01:04f9:002b:0f53:0000:0000:0000:0002,2a01:04f9:002b:151f:0095:0216:0101:0247,2a01:04f9:002b:2e4c:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 469"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522468; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:002b:31a0:0000:0000:0000:0002,2a01:04f9:003a:271f:0003:0000:0000:0064,2a01:04f9:003a:2b96:0000:0000:0000:0000,2a01:04f9:003b:468e:0000:0000:0000:0013,2a01:04f9:004a:1812:0000:0000:0000:0002,2a01:04f9:004a:2aa4:0000:0000:0000:0002,2a01:04f9:004a:2e4e:0000:0000:0000:0002,2a01:04f9:004a:2e4e:0000:0000:0000:0003,2a01:04f9:004a:2e4e:0000:0000:0000:0004,2a01:04f9:004a:42a4:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 470"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522469; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:004a:4442:0000:0000:0000:0002,2a01:04f9:004a:4442:0000:0000:0000:0003,2a01:04f9:004a:4442:0000:0000:0000:0004,2a01:04f9:004a:4442:0000:0000:0000:dead,2a01:04f9:004a:48d0:0000:0000:0000:0011,2a01:04f9:004a:f004:0000:0000:0000:000a,2a01:04f9:004b:16ac:0000:0000:0000:0002,2a01:04f9:004b:2044:0000:0000:0000:0002,2a01:04f9:004b:4268:0000:0000:0000:0002,2a01:04f9:004b:4e97:0000:0000:0000:6666] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 471"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522470; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:005a:442b:0000:0000:0000:0003,2a01:04f9:005a:442b:0000:0000:0000:0004,2a01:04f9:005a:442b:0000:0000:0000:0006,2a01:04f9:006a:528d:0000:0000:0000:000a,2a01:04f9:006b:19a2:0000:0000:0000:0002,2a01:04f9:006b:204b:0000:0000:0000:0002,2a01:04f9:006b:3408:0000:0000:0000:0002,2a01:04f9:006b:3408:0000:0000:0000:0003,2a01:04f9:006b:3408:0000:0000:0000:0004,2a01:04f9:006b:4a05:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 472"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522471; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:3051:13ca:0000:0000:0000:0002,2a01:04f9:3051:13ca:0000:0000:0000:0003,2a01:04f9:3051:13ca:0000:0000:0000:0004,2a01:04f9:3051:13ca:0000:0000:0000:0005,2a01:04f9:3051:13ca:0000:0000:0000:0006,2a01:04f9:3051:13ca:0000:0000:0000:0007,2a01:04f9:3051:13ca:0bad:babe:ca11:0911,2a01:04f9:3051:3c1e:0000:0000:0000:0002,2a01:04f9:3051:4167:0bad:babe:ca11:0911,2a01:04f9:3051:47e3:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 473"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522472; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:3051:526c:0000:0000:0000:0002,2a01:04f9:3051:526c:0000:0000:0000:0003,2a01:04f9:3051:526c:0000:0000:0000:0004,2a01:04f9:3070:1c9d:0000:0000:0000:0000,2a01:04f9:3081:3520:0000:0000:0000:0002,2a01:04f9:3081:414c:0000:0000:0000:0002,2a01:04f9:c010:049b:0000:0000:0000:0159,2a01:04f9:c010:0a48:0000:0000:0000:0001,2a01:04f9:c010:121f:0000:0000:0000:9001,2a01:04f9:c010:1997:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 474"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522473; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:c010:2697:0000:0000:0000:0001,2a01:04f9:c010:33ef:0000:0000:0000:0001,2a01:04f9:c010:3b44:0000:0000:0000:0001,2a01:04f9:c010:4d4e:0000:0000:0000:0001,2a01:04f9:c010:516b:0000:0000:0000:0001,2a01:04f9:c010:607c:0000:0000:0000:0001,2a01:04f9:c010:609a:0000:0000:0000:0001,2a01:04f9:c010:6a56:0000:0000:0000:0001,2a01:04f9:c010:6abe:0000:0000:0000:0001,2a01:04f9:c010:6b27:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 475"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522474; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:c010:71a9:0000:0000:0000:0001,2a01:04f9:c010:7573:0000:0000:0000:0001,2a01:04f9:c010:9cbb:0000:0000:0000:0001,2a01:04f9:c010:9d66:0000:0000:0000:0001,2a01:04f9:c010:9ed2:0000:0000:0000:0001,2a01:04f9:c010:a04a:0000:0000:0000:0001,2a01:04f9:c010:af50:0000:0000:0000:0001,2a01:04f9:c010:b3db:0000:0000:0000:0001,2a01:04f9:c010:b8b3:0000:0000:0000:0001,2a01:04f9:c010:c870:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 476"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522475; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:c010:cf70:0000:0000:0000:0001,2a01:04f9:c010:e041:0000:0000:0000:0001,2a01:04f9:c010:ec2a:0000:0000:0000:0001,2a01:04f9:c011:01c3:0000:0000:0000:0001,2a01:04f9:c011:1a04:0000:0000:0000:0001,2a01:04f9:c011:8cca:0000:0000:0000:0001,2a01:04f9:c011:b2fd:0000:0000:0000:0001,2a01:04f9:c012:6094:0000:0000:0000:0001,2a01:04f9:c012:6671:0000:0000:0000:0001,2a01:04f9:c012:6cc4:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 477"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522476; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04f9:c012:7412:0000:0000:0000:0001,2a01:04f9:c012:82ea:0000:0000:0000:0001,2a01:04f9:c012:883a:0000:0000:0000:0001,2a01:04f9:c012:b0e6:0000:0000:0000:0001,2a01:04f9:c012:bcdc:0000:0000:0000:0001,2a01:04f9:c012:e837:0000:0000:0000:0001,2a01:04f9:c01f:0030:0000:0000:0000:0001,2a01:04ff:00f0:2ecb:0000:0000:0000:0001,2a01:04ff:00f0:333b:0000:0000:0000:0001,2a01:04ff:00f0:4268:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 478"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522477; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:04ff:00f0:92a3:0000:0000:0000:0001,2a01:04ff:00f0:c3c8:0000:0000:0000:0000,2a01:04ff:01f0:ce77:0000:0000:0000:0001,2a01:04ff:01f0:e16e:1a48:1e71:5055:de68,2a01:04ff:01f0:e387:0000:0000:0000:0001,2a01:04ff:01f0:e791:0000:0000:0000:0001,2a01:05e0:0036:c506:0000:0000:0000:0001,2a01:05e0:0036:c93f:0000:0000:0000:0001,2a01:05e0:0036:cf2a:0000:0000:0000:0001,2a01:0799:0242:7400:536f:2f13:3502:fb6d] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 479"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522478; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:07a7:0002:3c16:0000:0000:eda0:b29d,2a01:07c8:aac1:0114:0000:0000:0000:1337,2a01:07c8:aaca:0505:5772:0e7a:673e:b7fb,2a01:07c8:bb01:0994:5054:00ff:fef0:e955,2a01:0e0a:00b5:7f50:7278:4422:dc14:89ea,2a01:0e0a:0281:be00:b6c4:b1e4:1c19:abfd,2a01:0e0a:05d6:6de0:0000:0000:acab:0003,2a01:0e0a:05e4:01d0:0000:0000:0000:acab,2a01:0e0a:0b3a:1dd0:db1f:b4d9:4ce8:e9a6,2a01:0e0a:0bfa:a280:428d:5cff:fed1:b07b] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 480"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522479; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:0e11:1013:8280:df58:94c5:0fed:dc14,2a01:0e34:ec29:e1e0:179d:47f9:49af:7542,2a01:0e34:ec42:1880:0000:0000:0000:0002,2a01:4262:01ab:ffff:0000:0000:0000:0133,2a01:6340:0002:0501:0000:0000:0000:0010,2a01:6340:0002:0501:0000:0000:0000:0020,2a01:7e00:0000:0000:f03c:91ff:fe56:2656,2a01:7e00:0000:0000:f03c:91ff:fe62:716a,2a01:7e00:0000:0000:f03c:91ff:fe70:e0b8,2a01:7e00:0000:0000:f03c:92ff:fe8d:d119] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 481"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522480; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:7e00:0000:0000:f03c:92ff:fe96:d244,2a01:7e00:0000:0000:f03c:93ff:feae:4153,2a01:7e00:0000:0000:f03c:94ff:feb9:e88b,2a01:7e00:0000:0000:f03c:94ff:fecc:b297,2a01:7e00:0000:0000:f03c:94ff:fecf:ba7d,2a01:7e01:0000:0000:f03c:91ff:fe39:a130,2a01:7e01:0000:0000:f03c:91ff:feb7:87d8,2a01:7e01:0000:0000:f03c:92ff:fe58:5755,2a01:7e01:0000:0000:f03c:92ff:fec2:273e,2a01:7e01:0000:0000:f03c:93ff:fe27:3af9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 482"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522481; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:7e03:0000:0000:f03c:93ff:fe6e:0f11,2a01:7e03:0000:0000:f03c:93ff:fe6e:ec57,2a01:7e03:0000:0000:f03c:94ff:fe8e:0cf0,2a01:7e04:0000:0000:f03c:93ff:fe6e:0f3a,2a01:7e04:0000:0000:f03c:93ff:fe6e:eca8,2a01:7e04:0000:0000:f03c:94ff:fefc:52ce,2a01:8640:000a:0000:0000:0000:6163:8bf8,2a01:8640:000f:0000:0000:0000:86f8:57d7,2a01:a500:2766:0000:0000:0000:0d04:d3cc,2a01:a500:2766:0000:0000:0000:2e08:6313] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 483"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522482; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a01:cb15:8296:1100:02a0:98ff:fe22:8e77,2a01:cb15:8296:1100:02a0:98ff:fe65:28db,2a02:00ec:3206:b001:0000:0000:0000:0001,2a02:0168:4800:0000:0000:0000:0000:0031,2a02:0168:4f3f:0005:beae:c5ff:fe10:2c02,2a02:0168:6426:0000:0000:0000:0000:0011,2a02:0168:6a16:1130:0000:0000:0032:0101,2a02:0168:6a16:1130:0000:0000:0032:0102,2a02:0168:6f7f:0020:0000:0000:0000:1111,2a02:0168:6f7f:0020:0000:0000:0000:5555] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 484"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522483; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:0168:83d4:7777:44bd:c9ff:fe2e:3165,2a02:0168:83d4:7777:48b6:8fff:feb0:bb1e,2a02:0168:ae0d:0099:0000:0000:0000:0011,2a02:0168:ae0d:0199:0000:0000:0000:1111,2a02:0168:b5cf:0004:0000:0000:0000:0002,2a02:0168:c603:0b01:0000:0000:0000:0042,2a02:0180:0001:0001:0000:0000:0517:1260,2a02:0180:0006:0001:0000:0000:0000:01fa,2a02:0180:0006:0001:0000:0000:0000:03d8,2a02:0180:0006:0001:0000:0000:0000:0588] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 485"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522484; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:0180:0006:0001:0000:0000:0000:2eee,2a02:0180:0006:0001:0000:0000:0000:2f16,2a02:0180:0006:0001:0000:0000:0000:2fce,2a02:0180:0006:0001:0000:0000:0000:2fcf,2a02:0238:f04b:4125:0000:0000:0000:0000,2a02:0248:0002:41dc:5054:00ff:fe80:010f,2a02:0390:9854:0040:8c84:91ff:fe56:1a76,2a02:0418:6017:0000:0000:0000:0000:0147,2a02:0418:6017:0000:0000:0000:0000:0148,2a02:0578:853f:1500:0c3a:9071:affd:3f1b] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 486"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522485; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:0578:85c9:1801:c2e3:1224:bb37:8208,2a02:0752:0000:0018:0000:0000:0000:17c2,2a02:0898:0218:0000:0000:0000:0000:0001,2a02:0898:0218:0000:0000:0000:0000:0002,2a02:0908:1082:4b11:0000:0000:eeee:1111,2a02:0b08:0000:0002:0000:0000:0000:0017,2a02:0b08:0000:0002:0000:0000:0000:0019,2a02:0ec0:0209:0010:0000:0000:0000:0004,2a02:1210:4a01:cf32:dead:babe:beef:cafe,2a02:1348:0179:9145:0024:19ff:fee6:4516] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 487"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522486; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:13f0:8100:0006:0688:5fe9:2e1f:0001,2a02:16a8:0662:2203:0000:0000:0000:0001,2a02:16d0:0000:0005:0000:0000:0000:0001,2a02:1811:0d0d:1d00:0000:0000:dead:beef,2a02:181f:0000:0121:1dc2:d3c5:1a04:ef05,2a02:2454:04a0:9500:0216:3eff:feab:cd03,2a02:247a:020c:6c00:0000:0000:0000:0001,2a02:247a:0210:1b00:0000:0000:0000:0001,2a02:247a:0210:3200:0000:0000:0000:0001,2a02:247a:021d:3a00:0001:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 488"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522487; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:247a:022b:a300:0001:0000:0000:0001,2a02:247a:022c:8b00:0001:0000:0000:0001,2a02:247a:0234:7b00:0000:0000:0000:0001,2a02:247a:0238:af00:0000:0000:0000:0001,2a02:247a:0247:a700:0001:0000:0000:0001,2a02:247a:0249:2600:0000:0000:0000:0001,2a02:247a:025c:0500:0000:0000:0000:0001,2a02:247a:025c:9d00:0000:0000:0000:0001,2a02:247a:025d:3d00:0000:0000:0000:0001,2a02:247a:0264:0c00:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 489"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522488; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:247a:0266:b600:0000:0000:0000:0001,2a02:247a:026f:e700:0000:0000:0000:0001,2a02:247a:0276:fa00:0000:0000:0000:0001,2a02:2780:0000:0000:0000:0000:0000:e01a,2a02:27a8:0000:000a:0000:0000:0000:0100,2a02:27a8:0000:000a:0000:0000:0000:012b,2a02:27aa:0000:0000:0000:0000:0000:0088,2a02:27aa:0000:0000:0000:0000:0000:00ce,2a02:27aa:0000:0000:0000:0000:0000:0505,2a02:27ab:0000:0002:0000:0000:0000:0022] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 490"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522489; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:27ac:0000:0000:0000:0000:0000:0120,2a02:2970:1001:0000:0000:0000:0000:004b,2a02:29e0:0001:0440:0108:0108:0108:0108,2a02:29e0:0002:0006:0001:0001:7760:bbd6,2a02:29e0:0002:0006:0001:0001:a133:c170,2a02:2b80:0101:0104:0000:0000:0000:0d25,2a02:2b88:0002:0001:0000:0000:4205:0001,2a02:2b88:0002:0716:0000:0000:0000:0001,2a02:4780:0010:b836:0000:0000:0000:0001,2a02:4840:0002:0226:3f94:580d:29c3:87f5] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 491"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522490; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:6b60:0000:003d:0000:0000:0000:0036,2a02:6b66:1174:0001:84d1:a48b:b719:6949,2a02:7aa0:1201:0000:0000:0000:b5e4:ac7c,2a02:7aa0:1619:0000:0000:0000:ba45:e7f2,2a02:7aa0:4000:0000:0000:0000:0000:0252,2a02:7b40:b0df:8d6a:0000:0000:0000:0001,2a02:7b40:d418:648a:0000:0000:0000:0001,2a02:8010:60a1:2013:0000:0000:0000:0001,2a02:8010:67ae:0005:4f4e:c47d:1783:952d,2a02:8071:3e85:bc60:0000:0000:0000:4a11] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 492"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522491; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:8071:4488:4800:c654:44ff:fe8c:125c,2a02:8109:8000:000d:0000:0000:0000:2133,2a02:8109:890a:e200:42b0:34ff:fe36:0d87,2a02:810d:0400:119e:291d:9e3c:91bf:a5dd,2a02:810d:0400:119e:5bed:8e85:3314:8cc6,2a02:810d:0400:119e:ebf0:b25f:67c4:bcd7,2a02:a03f:efea:ae1b:ca7f:54ff:fe5c:9b33,2a02:a452:9bf7:0001:82ee:73ff:fe67:f076,2a02:a468:8d92:0001:0000:0000:0000:0baf,2a02:a468:8d92:0001:0001:000c:0bad:c0de] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 493"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522492; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:a468:8d92:0001:1e86:0bff:fe20:02c8,2a02:a469:a88b:0001:5a9c:fcff:fe04:34c2,2a02:a46c:5d12:0001:7e10:c9ff:feb9:0ebc,2a02:c202:3014:1921:0000:0000:0000:0001,2a02:c205:1000:6686:0000:0000:0000:0005,2a02:c205:2020:6054:0000:0000:0000:0001,2a02:c205:3001:7714:0000:0000:0000:0003,2a02:c205:3003:5755:0000:0000:0000:0001,2a02:c206:2115:0844:0000:0000:0000:0001,2a02:c206:2154:8910:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 494"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522493; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:c206:2157:1486:0000:0000:0000:0001,2a02:c206:3009:9446:0000:0000:0000:0001,2a02:c206:3010:1580:0000:0000:0000:0001,2a02:c206:3010:8083:0000:0000:0000:0001,2a02:c206:3011:0733:0000:0000:0000:0001,2a02:c206:3012:6986:0000:0000:0000:0001,2a02:c206:3013:4077:0000:0000:0000:0001,2a02:c206:3013:5744:0000:0000:0000:0001,2a02:c206:3013:8914:0000:0000:0000:0001,2a02:c206:3013:9648:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 495"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522494; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:c207:2006:2287:0000:0001:0000:0001,2a02:c207:2023:2621:0000:0000:0000:0001,2a02:c207:2025:1163:0000:0000:0000:0001,2a02:c207:2030:4712:0000:0000:0000:0001,2a02:c207:2033:4966:0000:0000:0000:0001,2a02:c207:2034:5805:0000:0000:0000:0001,2a02:c207:2089:0786:0000:0000:0000:0001,2a02:c207:2098:7239:0000:0000:0000:0001,2a02:c207:3000:8469:0000:0000:0000:0001,2a02:c207:3001:6426:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 496"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522495; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:c207:3002:3972:0000:0000:0000:0001,2a02:c207:3002:8283:0000:0000:0000:0001,2a02:c207:3002:8686:0000:0000:0000:0066,2a02:c207:3003:0935:0000:0000:0000:0001,2a02:c207:3003:1052:0000:0000:0000:0001,2a02:c207:3004:0406:0000:0000:0000:0001,2a02:c207:3004:1074:0000:0000:0000:0001,2a02:c207:3005:0233:0000:0000:0000:0001,2a02:c207:3005:1808:0000:0000:0000:0001,2a02:c207:3006:5763:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 497"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522496; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a02:c207:3006:5899:0000:0000:0000:0001,2a02:c500:0002:00f0:0000:0000:0000:5492,2a02:ed06:0000:0000:0000:0000:0000:0222,2a02:f640:0000:0008:0000:0000:0002:070f,2a03:0f80:0048:0037:0235:0048:0247:0001,2a03:0f80:0354:0037:0235:0049:0138:0001,2a03:0f80:ed15:0149:0154:0152:0121:0001,2a03:0f80:ed15:0158:0255:0212:0178:0002,2a03:0f80:ed15:881e:0000:0000:0000:0001,2a03:3b40:00fe:01e2:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 498"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522497; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0001:047e:0000:0000:0000:0443,2a03:4000:0002:00e5:0000:0000:0000:0001,2a03:4000:0002:025d:241d:aeff:fe7b:bf99,2a03:4000:0002:0ba4:88e9:0eff:fe89:3637,2a03:4000:0005:0613:9872:48ff:fede:289d,2a03:4000:0005:065b:388a:15ff:fedc:30d6,2a03:4000:0006:0614:d803:40ff:fec3:832a,2a03:4000:0006:102b:c457:f3ff:feb0:a6d0,2a03:4000:0006:1051:0000:0000:0000:0001,2a03:4000:0006:10c8:d467:7aff:feaf:96aa] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 499"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522498; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0006:10ca:0000:0000:0000:0001,2a03:4000:0006:2388:df98:15f9:b34d:0443,2a03:4000:0006:3698:0000:0000:0000:11e8,2a03:4000:0006:5059:c831:caff:feb8:4f7e,2a03:4000:0006:543b:0000:0000:0000:0443,2a03:4000:0006:543f:78b2:4fff:fe7b:fb6a,2a03:4000:0006:724c:df98:15f9:b34d:0443,2a03:4000:0006:d009:2844:01ff:feec:de5e,2a03:4000:0006:d042:5440:88ff:fedd:4ae5,2a03:4000:0006:d0b2:2862:dcff:fe26:31fd] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 500"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522499; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0006:e047:6494:62ff:fe3f:85b8,2a03:4000:0006:f776:5862:30ff:fecf:0d2c,2a03:4000:0006:f808:948b:b5ff:fe41:2238,2a03:4000:0006:f847:745e:86ff:feb5:b3c8,2a03:4000:0007:0649:e8b3:63ff:fe9a:5e24,2a03:4000:0007:064d:547b:27ff:fe79:b9e0,2a03:4000:0008:02a9:0000:0000:0000:0000,2a03:4000:0008:03c1:0000:0000:0000:9001,2a03:4000:0008:0503:048d:0bff:fe2a:1010,2a03:4000:0008:061b:085e:b6ff:fefa:8752] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 501"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522500; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0008:069a:74ab:8fff:fe06:a47a,2a03:4000:0009:009c:2837:19ff:fe72:cc69,2a03:4000:0009:0635:c48e:47ff:fea8:0490,2a03:4000:000a:0071:dead:beef:0000:0001,2a03:4000:000a:0072:0000:0000:0000:1337,2a03:4000:000f:004c:e878:7fff:fe35:105d,2a03:4000:000f:00b0:0000:0000:0000:0001,2a03:4000:000f:064f:5443:78ff:fe62:7ad8,2a03:4000:000f:0992:98d8:54ff:fe3d:fc2b,2a03:4000:0010:005a:e889:a0ff:fed2:e913] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 502"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522501; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0013:0aeb:0000:0000:0000:0001,2a03:4000:0015:0928:dead:beef:ca1f:1337,2a03:4000:0017:001c:48cf:0cff:fe56:939b,2a03:4000:0017:0082:d4ac:5fff:fe6f:f2fe,2a03:4000:0017:0098:0000:0000:cafe:6a7e,2a03:4000:0017:0688:b854:07ff:fe48:bdcb,2a03:4000:0017:0a15:d4db:fbff:fef4:8b7b,2a03:4000:0019:0040:4804:2fff:fe4c:9cc1,2a03:4000:0019:013c:88c5:80ff:fe09:93d7,2a03:4000:001a:01f5:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 503"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522502; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:001a:05c5:38dc:87ff:fe07:85fb,2a03:4000:001a:05dc:242e:cbff:fe4d:cb31,2a03:4000:001a:05de:6489:b7ff:fe8f:8434,2a03:4000:001a:06a0:8857:fcff:fe0f:24a0,2a03:4000:001a:06f8:98f0:87ff:fe6a:29af,2a03:4000:001c:079d:0000:0000:0000:0001,2a03:4000:001d:003d:1827:b1ff:feec:f6b0,2a03:4000:001d:0b7a:782f:17ff:fef0:a708,2a03:4000:001e:0081:c835:7dff:fe90:3ed5,2a03:4000:001e:0119:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 504"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522503; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:001e:07be:aef4:d6c6:923c:e658,2a03:4000:001e:07d4:84fb:5fff:fef3:9d56,2a03:4000:0021:00ca:0000:0000:0000:0002,2a03:4000:0021:0115:8837:15ff:fe14:64cc,2a03:4000:0021:0224:0000:0000:0000:0001,2a03:4000:0021:089c:b8d4:46ff:fe68:40db,2a03:4000:0021:08a8:dead:beef:ca1f:1337,2a03:4000:0022:0062:0000:0000:0000:0002,2a03:4000:0022:0175:a452:acff:fefc:987f,2a03:4000:0023:0678:b846:78ff:fe18:5ec3] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 505"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522504; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0024:00b3:0000:0000:0000:0443,2a03:4000:0027:0036:c813:6dff:fe0e:b93e,2a03:4000:0027:06f8:e466:27ff:fe82:1b2a,2a03:4000:0027:071a:1853:7aff:feaf:449b,2a03:4000:0028:003e:c4ee:b0ff:fecb:1cde,2a03:4000:0028:0174:3838:ceff:fe4b:a166,2a03:4000:0028:0900:786f:7fff:fe08:8217,2a03:4000:0028:097e:84fa:09ff:fef2:0cc0,2a03:4000:0029:021a:d4d3:beff:fefb:bdd9,2a03:4000:0029:08a9:887f:9eff:feed:09e9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 506"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522505; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:002a:00d6:949c:84ff:fe0c:84ba,2a03:4000:002b:0009:a4e0:1fff:fe06:d2f3,2a03:4000:002b:0077:d412:0aff:fecc:a4fd,2a03:4000:002b:066e:dead:beef:ca1f:1337,2a03:4000:002b:0673:24da:28ff:feb5:e5c5,2a03:4000:002b:100a:84de:15ff:fee1:df4b,2a03:4000:002b:1039:a84c:efff:fe99:f6d9,2a03:4000:002b:107f:8484:06ff:fee1:4640,2a03:4000:002b:1110:98fa:96ff:fe08:d530,2a03:4000:0031:0141:0000:0000:0000:1337] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 507"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522506; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0033:006c:346d:daff:fef4:10de,2a03:4000:0033:01c8:0000:0000:0000:0013,2a03:4000:0035:018e:a48b:3dff:fe5d:9ae5,2a03:4000:0036:0024:0000:0000:0000:0001,2a03:4000:0036:0070:64a7:84ff:fede:1ca5,2a03:4000:0037:0003:e842:02ff:feb9:c49c,2a03:4000:0037:004c:d4de:c1ff:fe31:7d1f,2a03:4000:0037:0063:4427:b8ff:fe6a:881e,2a03:4000:0037:01e5:0000:0000:0000:0002,2a03:4000:0037:01fc:487b:b7ff:fe13:839b] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 508"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522507; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0037:0645:0000:0000:0000:0000,2a03:4000:0037:076e:68f6:30ff:fe7c:00a4,2a03:4000:0037:077c:0000:0000:0000:0010,2a03:4000:0038:0245:0000:0000:0000:0001,2a03:4000:0039:0098:c4a8:fcff:fed3:8505,2a03:4000:0039:00a6:144c:a2ff:fe4e:5230,2a03:4000:0039:00e7:98ab:00ff:fe95:7778,2a03:4000:003e:0568:446c:e7ff:fe7d:de4f,2a03:4000:003f:0012:9460:76ff:fe49:d419,2a03:4000:003f:0074:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 509"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522508; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0040:0023:0000:0000:0000:0001,2a03:4000:0040:006a:5829:22ff:fedd:b07f,2a03:4000:0041:0134:9886:21ff:fed8:1355,2a03:4000:0041:02a7:0000:0000:0000:0001,2a03:4000:0042:0078:c4f9:9fff:fefa:980c,2a03:4000:0043:0216:5443:2bff:fe16:c6b5,2a03:4000:0043:026f:0000:0000:0000:0001,2a03:4000:0045:0016:0000:0000:0000:0001,2a03:4000:0046:0095:0000:0000:0000:0001,2a03:4000:0046:011c:8459:ecff:fee4:9a99] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 510"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522509; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0046:0184:180b:04ff:fe38:ccd0,2a03:4000:0046:0197:b434:d3ff:fe68:d9e1,2a03:4000:0047:0631:a437:b1ff:fe5c:74a2,2a03:4000:0048:004d:88c8:8eff:fee8:9d1a,2a03:4000:0048:01bd:4859:20ff:fe6f:38fe,2a03:4000:0048:0694:c4f2:aaff:fe78:6dfc,2a03:4000:0049:05ce:5445:03ff:fe6f:c7c3,2a03:4000:0049:06c4:0000:0000:0000:0001,2a03:4000:004a:0c5f:0000:0000:0000:0001,2a03:4000:004a:0d4a:8495:5eff:fe5b:6099] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 511"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522510; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:004a:0fb8:086c:21ff:fe56:f680,2a03:4000:004c:0b27:a410:8eff:feb3:1c4a,2a03:4000:004d:0c92:88c0:96ff:fec6:0b9d,2a03:4000:004d:0cf0:0000:0000:0000:0001,2a03:4000:004d:0f78:98ca:02ff:fe35:798d,2a03:4000:004d:0f9e:0000:0000:0000:0001,2a03:4000:004e:0067:0000:0000:0000:0001,2a03:4000:004e:0c87:0000:0000:0000:0001,2a03:4000:004f:09dd:941d:48ff:fe68:323d,2a03:4000:004f:0c0d:0001:0000:0000:0000] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 512"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522511; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0050:0097:0000:0000:0000:0001,2a03:4000:0050:0a0c:84a9:c1ff:fe4a:4ae9,2a03:4000:0050:0e1b:842c:42ff:fedc:e5c6,2a03:4000:0050:0e4c:0000:0000:0000:0000,2a03:4000:0051:007c:0000:0000:0000:0001,2a03:4000:0052:00a5:7857:4cff:fec3:8881,2a03:4000:0054:00da:044b:56ff:fecc:0b1d,2a03:4000:0056:0090:e4ce:e3ff:fe49:5558,2a03:4000:0056:0091:480a:eeff:fea8:f9c6,2a03:4000:0056:0a67:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 513"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522512; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0056:0c1b:0000:0000:0000:0001,2a03:4000:0058:007d:0de1:0ea7:dead:beef,2a03:4000:0058:09d2:088f:58ff:feca:3aaf,2a03:4000:005b:0563:0000:0000:0000:0001,2a03:4000:005c:0067:d4f7:caff:fe20:5004,2a03:4000:005d:0b8f:1478:68ff:fec4:27c7,2a03:4000:005d:0e6a:d8cc:e3ff:fea6:f015,2a03:4000:005d:0ecb:d4d0:5eff:fed6:b075,2a03:4000:005d:0fab:0000:0000:0000:0001,2a03:4000:005e:0c47:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 514"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522513; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:005e:0ec0:0000:0000:0000:0001,2a03:4000:005f:0006:c470:05ff:fecf:789e,2a03:4000:0062:0008:c855:23ff:fef6:50ee,2a03:4000:0062:0ec7:d42a:41ff:feac:7169,2a03:4000:0062:0f06:7777:7777:7777:7777,2a03:4000:0064:0d6f:3855:34ff:fe06:0ba9,2a03:4000:0064:0e83:c491:b8ff:feb0:f90e,2a03:4000:0064:0fe8:c853:14ff:fe86:7a3d,2a03:4000:0066:0015:18a0:6bff:fe90:3147,2a03:4000:0066:0d0e:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 515"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522514; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:0066:0d88:6469:50ff:fe0b:98a8,2a03:4000:0067:0d1a:c44b:31ff:fea5:7443,2a03:4000:0067:0d31:481d:9dff:fe88:77e3,2a03:4000:0068:0c65:542b:f3ff:fefc:ca96,2a03:4000:0068:0c73:0000:0000:0000:0000,2a03:4000:0069:0d77:1869:5aff:fe29:fa22,2a03:4000:0069:0e40:0000:0000:0000:0001,2a03:4000:0069:0e5b:a4ec:edff:fed8:ed74,2a03:4000:006a:0037:0000:0000:0000:0001,2a03:4000:006a:0270:08ac:87ff:fe9e:7573] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 516"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522515; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:4000:006b:009c:7830:35ff:fe23:d89b,2a03:4000:006b:0191:9825:1cff:fe34:0bbe,2a03:4000:006b:024d:7428:02ff:fe6c:eefe,2a03:6000:6f68:0628:0000:0000:0000:0167,2a03:6300:0000:0be9:0000:0000:0000:0010,2a03:69e0:c020:3201:ba27:ebff:fe84:946b,2a03:75c0:0027:0fc0:0000:0000:0000:0001,2a03:75c0:002e:2056:f982:0000:0000:0001,2a03:75c0:0036:2124:0000:0000:0000:0001,2a03:8600:0000:0000:0000:0000:0000:00a1] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 517"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522516; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:8600:0000:0000:0000:0000:0000:00a2,2a03:8600:0000:0000:0000:0000:0000:00a3,2a03:8600:0000:0000:0000:0000:0000:00a4,2a03:8600:0000:0000:0000:0000:0000:00a5,2a03:8600:0000:0000:0000:0000:0000:00a6,2a03:90c0:0083:2908:0000:0000:0000:009e,2a03:90c0:0094:ffff:0000:0000:0000:0349,2a03:90c0:0094:ffff:0000:0000:0000:06a1,2a03:90c0:0195:0000:0000:0000:0000:0262,2a03:90c0:01b5:ffff:0000:0000:0072:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 518"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522517; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:90c0:05f1:2903:0000:0000:0000:1139,2a03:94e0:2421:dead:0000:0000:0000:0001,2a03:94e0:242c:dead:0000:0000:0000:0001,2a03:94e0:243a:dead:0000:0000:0000:0001,2a03:94e0:24a1:dead:0000:0000:0000:0001,2a03:94e0:24d4:0000:0000:0000:0000:0002,2a03:94e0:24d4:0000:0000:0000:0000:0003,2a03:94e0:24d4:0000:0000:0000:0000:0004,2a03:94e0:24d4:0000:0000:0000:0000:0005,2a03:94e0:24d4:0000:0000:0000:0000:0006] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 519"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522518; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:94e0:24d4:0000:0000:0000:0000:0007,2a03:94e0:24d4:0000:0000:0000:0000:0008,2a03:94e0:24d4:0000:0000:0000:0000:0009,2a03:94e0:2660:4819:0623:8331:4852:0001,2a03:94e0:ffff:0185:0181:0060:0000:0181,2a03:94e0:ffff:0185:0181:0061:0000:0018,2a03:94e0:ffff:0185:0181:0061:0000:0115,2a03:94e0:ffff:0185:0181:0061:0000:0142,2a03:94e0:ffff:0185:0243:0218:0000:0035,2a03:94e0:ffff:0185:0243:0218:0000:0041] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 520"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522519; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:94e0:ffff:0185:0243:0218:0000:0089,2a03:94e0:ffff:0185:0243:0218:0000:0110,2a03:94e0:ffff:0185:0243:0218:0000:0202,2a03:94e0:ffff:0185:0243:0218:0000:0204,2a03:94e0:ffff:0194:0032:0107:0000:0206,2a03:94e3:ffff:0198:0140:0141:0000:0051,2a03:94e3:ffff:0198:0140:0141:0000:0052,2a03:a140:0010:0e7f:0000:0000:0000:0001,2a03:b0c0:0001:00d0:0000:0000:01c8:4001,2a03:b0c0:0002:00d0:0000:0000:0dc3:8001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 521"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522520; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:b0c0:0002:00d0:0000:0000:0f43:5001,2a03:b0c0:0002:00d0:0000:0000:0fa0:9001,2a03:b0c0:0002:00d0:0000:0000:14cb:6001,2a03:b0c0:0002:00f0:0000:0000:01bc:9001,2a03:b0c0:0003:00d0:0000:0000:00dd:a001,2a03:b0c0:0003:00d0:0000:0000:0e05:8001,2a03:b0c0:0003:00d0:0000:0000:19ca:b001,2a03:b0c0:0003:00d0:0000:0000:19f5:b001,2a03:b0c0:0003:00d0:0000:0000:1a28:c001,2a03:cfc0:8000:0007:0000:0000:5fd6:3560] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 522"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522521; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:cfc0:8000:0007:0000:0000:5fd6:3561,2a03:e600:0100:0000:0000:0000:0000:0001,2a03:e600:0100:0000:0000:0000:0000:0002,2a03:e600:0100:0000:0000:0000:0000:0003,2a03:e600:0100:0000:0000:0000:0000:0004,2a03:e600:0100:0000:0000:0000:0000:0005,2a03:e600:0100:0000:0000:0000:0000:0006,2a03:e600:0100:0000:0000:0000:0000:0065,2a03:e600:0100:0000:0000:0000:0000:0066,2a03:e600:0100:0000:0000:0000:0000:0067] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 523"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522522; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a03:e600:0100:0000:0000:0000:0000:0068,2a03:e600:0100:0000:0000:0000:0000:0069,2a03:e600:0100:0000:0000:0000:0000:0070,2a03:e600:0100:0000:0000:0000:0000:0071,2a04:0204:1515:fc00:23ce:51c3:ca2d:874b,2a04:0c47:0e00:7cdf:04b9:a0ff:fe00:02f0,2a04:1741:0000:0012:0000:0000:0000:0000,2a04:2180:0000:0001:0000:0000:35da:3bca,2a04:2180:0000:0001:0000:0000:e308:9180,2a04:3541:8000:1000:78d3:3cff:fef7:0144] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 524"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522523; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a04:52c0:0101:0164:0000:0000:0000:0099,2a04:52c0:0101:046a:0000:0000:0000:0000,2a04:52c0:0102:46e0:0000:0000:0000:0001,2a04:52c0:0102:69e5:0000:0000:0000:0001,2a04:52c0:0103:0412:0000:0000:0000:0001,2a04:52c0:0103:5acd:0000:0000:0000:0001,2a04:52c0:0103:f7cb:0000:0000:0000:0001,2a04:52c0:0104:31e6:0000:0000:0000:0001,2a04:52c0:0104:4735:0000:0000:0000:0001,2a04:52c0:0104:ad97:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 525"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522524; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a04:52c0:0104:fe02:0000:0000:0000:0001,2a04:52c0:0105:78fc:0000:0000:0000:0001,2a04:52c0:0107:be74:0000:0000:0000:0001,2a04:52c0:0108:4b9e:0000:0000:0000:0001,2a04:52c0:0108:a34f:0000:0000:0000:0001,2a04:52c0:0113:898d:0000:0000:0000:0001,2a04:52c0:0116:0fa5:0000:0000:0000:0001,2a04:52c0:0116:e0e3:0000:0000:0000:0001,2a04:52c0:0117:7157:0000:0000:0000:0001,2a04:52c0:0119:3f0b:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 526"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522525; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a04:52c0:0121:65b6:0000:0000:0000:0001,2a04:52c0:0130:896e:0000:0000:0000:0001,2a04:52c0:0130:d285:0000:0000:0000:0001,2a04:9dc0:0000:0144:0000:0000:0000:0010,2a04:9dc0:0031:0000:0000:0000:c0cc:004d,2a04:ecc0:0008:00a8:4567:0152:0000:0001,2a04:ecc0:0008:00a8:4567:0491:0000:0001,2a04:ecc0:0008:00a8:4567:0625:0000:0001,2a04:ecc0:0008:00a8:4567:0801:0000:0001,2a04:ecc0:0008:00a8:4567:0892:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 527"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522526; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a04:ecc0:0008:00a8:4567:0906:0000:0001,2a04:ecc0:0008:00a8:4567:479b:0000:0001,2a05:0541:0110:0020:0000:0000:0000:0001,2a05:0541:0110:003e:0000:0000:0000:0001,2a05:0541:0121:0033:0000:0000:0000:0001,2a05:0541:0122:0049:0000:0000:0000:0001,2a05:0541:0123:000f:0000:0000:0000:0001,2a05:0541:0123:0010:0000:0000:0000:0001,2a05:1500:0600:0012:1c00:d7ff:fe00:5469,2a05:4140:0003:0000:0000:0000:0000:0150] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 528"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522527; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a05:4140:0003:0000:0000:0000:0000:0438,2a05:4140:0003:0000:0000:0000:0000:0530,2a05:4140:0056:0066:0000:0000:0000:0010,2a05:4140:0056:0066:0000:0000:0000:0011,2a05:4140:0056:0066:0000:0000:0000:0012,2a05:4140:0056:0066:0000:0000:0000:0013,2a05:41c0:0010:b900:0000:0000:0000:0001,2a05:4740:010f:0000:0000:0000:0000:0001,2a05:6e02:10c3:2810:be24:11ff:fe24:b382,2a05:9403:0000:0000:0000:0000:0000:0086] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 529"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522528; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a05:9403:0000:0000:0000:0000:0000:0215,2a05:9404:0000:0000:0000:0000:0000:02ba,2a05:b0c7:6005:2ea6:d212:f776:ccbb:cded,2a05:b0c7:602b:0000:0000:0000:0000:0001,2a05:b0c7:607b:0000:0000:0000:0000:0001,2a05:b0c7:6252:0000:0000:0000:0000:0001,2a05:b0c7:6388:0000:0000:0000:0000:0001,2a05:b0c7:6397:0000:0000:0000:0000:0001,2a05:b0c7:63bc:0000:0000:0000:0000:0001,2a05:b0c7:64e4:0000:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 530"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522529; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a05:b0c7:65f9:0000:0000:0000:0000:0001,2a05:b0c7:67c6:0000:0000:0000:0000:0001,2a05:b0c7:6949:0000:0000:0000:0000:0001,2a05:b0c7:6b72:0000:0000:0000:0000:0001,2a05:b0c7:6bd4:0000:0000:0000:0000:0001,2a05:b0c7:6d1b:0000:0000:0000:0000:0001,2a05:b0c7:6e62:0000:0000:0000:0000:0001,2a05:bec0:0001:0003:484b:9cff:fe5f:6259,2a05:bec0:0001:0003:ae71:feff:feff:958d,2a05:bec0:0001:0003:f484:05ff:fe15:6a98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 531"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522530; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a05:d011:0377:0f27:35a0:2e5a:08f9:1df3,2a05:d01c:0667:da01:ddac:e2ad:0605:3002,2a05:f480:1400:2df8:5400:04ff:feb6:e5c2,2a05:f480:2000:296e:5400:04ff:fe2c:37a5,2a05:f480:2000:2b45:5400:04ff:fe41:87e2,2a05:f480:2000:2eae:5400:04ff:fee2:25f7,2a05:f480:2400:16b7:5400:04ff:feb9:9706,2a05:f480:2400:176d:5400:03ff:fee0:e40a,2a05:f480:3000:22ce:5400:04ff:feec:1ff5,2a05:f6c7:8321:0000:0000:0000:0000:0160] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 532"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522531; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a06:0e80:3000:0001:0bad:babe:ca11:0911,2a06:1280:bee1:0002:0000:0000:ee12:0230,2a06:1700:0000:000b:0000:0000:44cb:00d7,2a06:1700:0000:000e:0000:0000:0000:0001,2a06:1700:0000:0010:0000:0000:0000:0001,2a06:1700:0000:0012:0000:0000:0000:0001,2a06:1700:0000:0012:0000:0000:0000:0002,2a06:1700:0000:0012:0000:0000:0000:0003,2a06:1700:0000:0012:0000:0000:0000:0004,2a06:1700:0000:0015:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 533"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522532; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a06:1700:0000:0015:0000:0000:0000:0002,2a06:1700:0000:0015:0000:0000:0000:0003,2a06:1700:0000:0015:0000:0000:0000:0004,2a06:1700:0000:0016:0000:0000:0000:0001,2a06:1700:0000:003c:0000:0000:0000:0001,2a06:1700:0000:0050:0000:0000:0000:0011,2a06:1700:0000:016b:0000:0000:0000:0011,2a06:1700:0003:0019:0000:0000:0000:0001,2a06:1700:0003:0034:0000:0000:0000:0001,2a06:1700:0004:0011:0007:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 534"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522533; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a06:1700:0004:0014:0000:0000:0000:0001,2a06:5b80:0167:0000:0000:0000:336e:f71b,2a06:5b87:0000:0000:0000:0000:b4f8:1e00,2a06:8184:0001:0008:0000:0000:0000:000a,2a06:8184:0001:0034:0000:0000:0000:000a,2a06:8184:0001:0039:0000:0000:0000:000a,2a06:8184:0001:0053:0000:0000:0000:000a,2a06:8184:0001:0055:0000:0000:0000:000a,2a06:8184:0001:0062:0000:0000:0000:000a,2a06:8184:0001:0063:0000:0000:0000:000a] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 535"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522534; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a06:8781:0000:0000:0000:0000:0000:0009,2a06:d380:0000:0103:0000:0000:0000:0062,2a06:d380:0000:0103:0000:0000:0000:0063,2a06:e880:0001:000f:0000:0000:0d15:ea5e,2a06:f900:0001:0100:0000:0000:0000:053a,2a06:f901:0001:0100:0300:ffff:01b1:a671,2a06:f901:8001:0100:0001:0000:7af0:36b2,2a07:0e01:0002:0013:0000:0000:0000:0002,2a07:0e01:0003:0049:0000:0000:0000:0001,2a07:0e01:0003:029e:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 536"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522535; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a07:0e03:002a:0000:0000:0000:0000:bcde,2a07:5741:0000:0504:0000:0000:0000:0001,2a07:e040:0002:0203:0000:0000:0000:0001,2a07:e041:0001:0088:0000:0000:0000:0001,2a09:11c0:1200:0210:ffff:ffff:8d62:884f,2a09:7183:0000:0000:0000:0000:fff1:0102,2a09:7c44:0000:00be:0000:0000:0000:0001,2a09:8340:55d0:4542:0000:0000:0000:0001,2a09:8740:0000:0003:0000:0000:0013:4008,2a09:be40:28fe:0000:4c8d:fcff:fe52:e27d] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 537"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522536; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a09:be40:28fe:0000:943b:16ff:feb3:0302,2a09:e1c1:efc1:1337:0000:0000:0000:9001,2a09:e1c1:efc2:1337:0000:0000:0000:9001,2a0a:3840:1337:0125:0000:b9c1:7dd0:1337,2a0a:3840:1337:0127:0000:b9c1:7f6c:1337,2a0a:4cc0:0000:0063:0000:0000:0000:0001,2a0a:4cc0:0000:0099:c44b:7eff:fe23:de3d,2a0a:4cc0:0000:0e35:c4dd:60ff:fe34:7d02,2a0a:4cc0:0000:0f0a:a45c:7aff:fe13:2781,2a0a:4cc0:0000:0f88:38d7:71ff:fe4e:f2f6] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 538"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522537; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0a:4cc0:0000:11b6:88c2:d9ff:fe4a:8104,2a0a:4cc0:0001:008b:000a:0000:0000:0010,2a0a:4cc0:0001:009e:0000:0000:0000:0001,2a0a:4cc0:0001:0101:a463:1eff:fee1:4874,2a0a:4cc0:0001:02e8:0430:d0ff:fe16:af4f,2a0a:4cc0:0001:10f9:4827:d3ff:fe72:b569,2a0a:4cc0:0001:1129:0000:0000:0000:0000,2a0a:4cc0:0001:1150:0000:0000:0000:0000,2a0a:4cc0:0001:11bb:0000:0000:0000:0002,2a0a:4cc0:0001:11c1:c80d:3dff:fe8c:eb6c] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 539"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522538; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0a:4cc0:0003:00c6:887f:3dff:feab:e676,2a0a:4cc0:0003:01f1:0200:0000:0000:0208,2a0a:4cc0:0100:02d1:0000:0000:0000:0003,2a0a:51c0:0000:006d:0000:0000:0000:0175,2a0a:51c0:0000:0136:0000:0000:0000:0002,2a0a:9300:00d1:0000:0000:0000:0000:09ab,2a0a:c801:0001:0008:0000:0000:0000:0012,2a0a:c801:0001:000e:0000:0000:0000:0050,2a0a:c801:0001:000e:0000:0000:0000:0093,2a0b:8bc0:0002:232a:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 540"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522539; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:b7c4:0001:0085:0000:0000:0000:0001,2a0b:cbc0:1100:0007:0000:0000:0000:0001,2a0b:cbc0:1100:001a:0000:0000:0000:0001,2a0b:ee80:000e:fefe:0000:0000:0000:0040,2a0b:ee80:000e:fefe:0000:0000:0000:0041,2a0b:f300:0406:0000:0000:0000:0000:0000,2a0b:f303:0463:0374:0000:0000:0000:5ce7,2a0b:f4c0:016c:0001:0000:0000:0000:0001,2a0b:f4c0:016c:0002:0000:0000:0000:0001,2a0b:f4c0:016c:0003:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 541"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522540; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c0:016c:0004:0000:0000:0000:0001,2a0b:f4c0:016c:0005:0000:0000:0000:0001,2a0b:f4c0:016c:0006:0000:0000:0000:0001,2a0b:f4c0:016c:0007:0000:0000:0000:0001,2a0b:f4c0:016c:0008:0000:0000:0000:0001,2a0b:f4c0:016c:0009:0000:0000:0000:0001,2a0b:f4c0:016c:0010:0000:0000:0000:0001,2a0b:f4c0:016c:0011:0000:0000:0000:0001,2a0b:f4c0:016c:0012:0000:0000:0000:0001,2a0b:f4c0:016c:0013:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 542"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522541; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c0:016c:0014:0000:0000:0000:0001,2a0b:f4c0:016c:0015:0000:0000:0000:0001,2a0b:f4c0:016c:0016:0000:0000:0000:0001,2a0b:f4c2:0000:0000:0000:0000:0000:0000,2a0b:f4c2:0000:0000:0000:0000:0000:0001,2a0b:f4c2:0000:0000:0000:0000:0000:0002,2a0b:f4c2:0000:0000:0000:0000:0000:0003,2a0b:f4c2:0000:0000:0000:0000:0000:0004,2a0b:f4c2:0000:0000:0000:0000:0000:0005,2a0b:f4c2:0000:0000:0000:0000:0000:0006] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 543"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522542; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0000:0000:0000:0000:0000:0007,2a0b:f4c2:0000:0000:0000:0000:0000:0008,2a0b:f4c2:0000:0000:0000:0000:0000:0009,2a0b:f4c2:0000:0000:0000:0000:0000:0010,2a0b:f4c2:0000:0000:0000:0000:0000:0011,2a0b:f4c2:0000:0000:0000:0000:0000:0012,2a0b:f4c2:0000:0000:0000:0000:0000:0013,2a0b:f4c2:0000:0000:0000:0000:0000:0014,2a0b:f4c2:0000:0000:0000:0000:0000:0015,2a0b:f4c2:0000:0000:0000:0000:0000:0016] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 544"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522543; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0000:0000:0000:0000:0000:0017,2a0b:f4c2:0000:0000:0000:0000:0000:0018,2a0b:f4c2:0000:0000:0000:0000:0000:0019,2a0b:f4c2:0000:0000:0000:0000:0000:0020,2a0b:f4c2:0000:0000:0000:0000:0000:0021,2a0b:f4c2:0000:0000:0000:0000:0000:0022,2a0b:f4c2:0000:0000:0000:0000:0000:0023,2a0b:f4c2:0000:0000:0000:0000:0000:0024,2a0b:f4c2:0000:0000:0000:0000:0000:0025,2a0b:f4c2:0000:0000:0000:0000:0000:0026] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 545"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522544; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0000:0000:0000:0000:0000:0027,2a0b:f4c2:0000:0000:0000:0000:0000:0028,2a0b:f4c2:0000:0000:0000:0000:0000:0029,2a0b:f4c2:0000:0000:0000:0000:0000:0030,2a0b:f4c2:0000:0000:0000:0000:0000:0031,2a0b:f4c2:0001:0000:0000:0000:0000:0128,2a0b:f4c2:0001:0000:0000:0000:0000:0130,2a0b:f4c2:0001:0000:0000:0000:0000:0132,2a0b:f4c2:0001:0000:0000:0000:0000:0133,2a0b:f4c2:0001:0000:0000:0000:0000:0134] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 546"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522545; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0001:0000:0000:0000:0000:0135,2a0b:f4c2:0001:0000:0000:0000:0000:0136,2a0b:f4c2:0001:0000:0000:0000:0000:0137,2a0b:f4c2:0001:0000:0000:0000:0000:0138,2a0b:f4c2:0001:0000:0000:0000:0000:0139,2a0b:f4c2:0001:0000:0000:0000:0000:0140,2a0b:f4c2:0001:0000:0000:0000:0000:0141,2a0b:f4c2:0001:0000:0000:0000:0000:0142,2a0b:f4c2:0001:0000:0000:0000:0000:0143,2a0b:f4c2:0001:0000:0000:0000:0000:0144] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 547"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522546; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0001:0000:0000:0000:0000:0145,2a0b:f4c2:0001:0000:0000:0000:0000:0146,2a0b:f4c2:0001:0000:0000:0000:0000:0147,2a0b:f4c2:0001:0000:0000:0000:0000:0148,2a0b:f4c2:0001:0000:0000:0000:0000:0149,2a0b:f4c2:0001:0000:0000:0000:0000:0150,2a0b:f4c2:0001:0000:0000:0000:0000:0152,2a0b:f4c2:0001:0000:0000:0000:0000:0153,2a0b:f4c2:0001:0000:0000:0000:0000:0154,2a0b:f4c2:0001:0000:0000:0000:0000:0155] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 548"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522547; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0001:0000:0000:0000:0000:0156,2a0b:f4c2:0001:0000:0000:0000:0000:0157,2a0b:f4c2:0001:0000:0000:0000:0000:0158,2a0b:f4c2:0001:0000:0000:0000:0000:0159,2a0b:f4c2:0001:0000:0000:0000:0000:0160,2a0b:f4c2:0001:0000:0000:0000:0000:0161,2a0b:f4c2:0001:0000:0000:0000:0000:0162,2a0b:f4c2:0001:0000:0000:0000:0000:0163,2a0b:f4c2:0001:0000:0000:0000:0000:0164,2a0b:f4c2:0001:0000:0000:0000:0000:0166] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 549"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522548; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0001:0000:0000:0000:0000:0167,2a0b:f4c2:0001:0000:0000:0000:0000:0168,2a0b:f4c2:0001:0000:0000:0000:0000:0169,2a0b:f4c2:0001:0000:0000:0000:0000:0170,2a0b:f4c2:0001:0000:0000:0000:0000:0171,2a0b:f4c2:0001:0000:0000:0000:0000:0172,2a0b:f4c2:0001:0000:0000:0000:0000:0173,2a0b:f4c2:0001:0000:0000:0000:0000:0174,2a0b:f4c2:0001:0000:0000:0000:0000:0175,2a0b:f4c2:0001:0000:0000:0000:0000:0176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 550"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522549; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0001:0000:0000:0000:0000:0177,2a0b:f4c2:0001:0000:0000:0000:0000:0178,2a0b:f4c2:0001:0000:0000:0000:0000:0179,2a0b:f4c2:0001:0000:0000:0000:0000:0180,2a0b:f4c2:0001:0000:0000:0000:0000:0181,2a0b:f4c2:0001:0000:0000:0000:0000:0182,2a0b:f4c2:0001:0000:0000:0000:0000:0183,2a0b:f4c2:0001:0000:0000:0000:0000:0185,2a0b:f4c2:0001:0000:0000:0000:0000:0186,2a0b:f4c2:0001:0000:0000:0000:0000:0187] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 551"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522550; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0001:0000:0000:0000:0000:0188,2a0b:f4c2:0001:0000:0000:0000:0000:0189,2a0b:f4c2:0001:0000:0000:0000:0000:0190,2a0b:f4c2:0001:0000:0000:0000:0000:0191,2a0b:f4c2:0002:0000:0000:0000:0000:0032,2a0b:f4c2:0002:0000:0000:0000:0000:0033,2a0b:f4c2:0002:0000:0000:0000:0000:0034,2a0b:f4c2:0002:0000:0000:0000:0000:0035,2a0b:f4c2:0002:0000:0000:0000:0000:0036,2a0b:f4c2:0002:0000:0000:0000:0000:0037] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 552"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522551; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0002:0000:0000:0000:0000:0038,2a0b:f4c2:0002:0000:0000:0000:0000:0039,2a0b:f4c2:0002:0000:0000:0000:0000:0040,2a0b:f4c2:0002:0000:0000:0000:0000:0041,2a0b:f4c2:0002:0000:0000:0000:0000:0042,2a0b:f4c2:0002:0000:0000:0000:0000:0043,2a0b:f4c2:0002:0000:0000:0000:0000:0044,2a0b:f4c2:0002:0000:0000:0000:0000:0045,2a0b:f4c2:0002:0000:0000:0000:0000:0046,2a0b:f4c2:0002:0000:0000:0000:0000:0047] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 553"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522552; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0002:0000:0000:0000:0000:0048,2a0b:f4c2:0002:0000:0000:0000:0000:0049,2a0b:f4c2:0002:0000:0000:0000:0000:0050,2a0b:f4c2:0002:0000:0000:0000:0000:0051,2a0b:f4c2:0002:0000:0000:0000:0000:0052,2a0b:f4c2:0002:0000:0000:0000:0000:0053,2a0b:f4c2:0002:0000:0000:0000:0000:0054,2a0b:f4c2:0002:0000:0000:0000:0000:0055,2a0b:f4c2:0002:0000:0000:0000:0000:0056,2a0b:f4c2:0002:0000:0000:0000:0000:0057] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 554"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522553; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0002:0000:0000:0000:0000:0058,2a0b:f4c2:0002:0000:0000:0000:0000:0059,2a0b:f4c2:0002:0000:0000:0000:0000:0060,2a0b:f4c2:0002:0000:0000:0000:0000:0061,2a0b:f4c2:0002:0000:0000:0000:0000:0062,2a0b:f4c2:0002:0000:0000:0000:0000:0063,2a0b:f4c2:0002:0001:0000:0000:0000:0192,2a0b:f4c2:0002:0001:0000:0000:0000:0193,2a0b:f4c2:0002:0001:0000:0000:0000:0194,2a0b:f4c2:0002:0001:0000:0000:0000:0195] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 555"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522554; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0002:0001:0000:0000:0000:0196,2a0b:f4c2:0002:0001:0000:0000:0000:0197,2a0b:f4c2:0002:0001:0000:0000:0000:0198,2a0b:f4c2:0002:0001:0000:0000:0000:0199,2a0b:f4c2:0002:0001:0000:0000:0000:0200,2a0b:f4c2:0002:0001:0000:0000:0000:0201,2a0b:f4c2:0002:0001:0000:0000:0000:0202,2a0b:f4c2:0002:0001:0000:0000:0000:0203,2a0b:f4c2:0002:0001:0000:0000:0000:0204,2a0b:f4c2:0002:0001:0000:0000:0000:0205] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 556"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522555; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0002:0001:0000:0000:0000:0206,2a0b:f4c2:0002:0001:0000:0000:0000:0207,2a0b:f4c2:0002:0001:0000:0000:0000:0208,2a0b:f4c2:0002:0001:0000:0000:0000:0209,2a0b:f4c2:0002:0001:0000:0000:0000:0210,2a0b:f4c2:0002:0001:0000:0000:0000:0211,2a0b:f4c2:0003:0000:0000:0000:0000:0064,2a0b:f4c2:0003:0000:0000:0000:0000:0065,2a0b:f4c2:0003:0000:0000:0000:0000:0066,2a0b:f4c2:0003:0000:0000:0000:0000:0067] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 557"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522556; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0003:0000:0000:0000:0000:0068,2a0b:f4c2:0003:0000:0000:0000:0000:0069,2a0b:f4c2:0003:0000:0000:0000:0000:0070,2a0b:f4c2:0003:0000:0000:0000:0000:0071,2a0b:f4c2:0003:0000:0000:0000:0000:0072,2a0b:f4c2:0003:0000:0000:0000:0000:0073,2a0b:f4c2:0003:0000:0000:0000:0000:0074,2a0b:f4c2:0003:0000:0000:0000:0000:0075,2a0b:f4c2:0003:0000:0000:0000:0000:0076,2a0b:f4c2:0003:0000:0000:0000:0000:0077] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 558"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522557; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0003:0000:0000:0000:0000:0078,2a0b:f4c2:0003:0000:0000:0000:0000:0079,2a0b:f4c2:0003:0000:0000:0000:0000:0080,2a0b:f4c2:0003:0000:0000:0000:0000:0081,2a0b:f4c2:0003:0000:0000:0000:0000:0082,2a0b:f4c2:0003:0000:0000:0000:0000:0083,2a0b:f4c2:0003:0000:0000:0000:0000:0084,2a0b:f4c2:0003:0000:0000:0000:0000:0085,2a0b:f4c2:0003:0000:0000:0000:0000:0086,2a0b:f4c2:0003:0000:0000:0000:0000:0087] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 559"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522558; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0003:0000:0000:0000:0000:0088,2a0b:f4c2:0003:0000:0000:0000:0000:0089,2a0b:f4c2:0003:0000:0000:0000:0000:0090,2a0b:f4c2:0004:0000:0000:0000:0000:0096,2a0b:f4c2:0004:0000:0000:0000:0000:0097,2a0b:f4c2:0004:0000:0000:0000:0000:0098,2a0b:f4c2:0004:0000:0000:0000:0000:0099,2a0b:f4c2:0004:0000:0000:0000:0000:0100,2a0b:f4c2:0004:0000:0000:0000:0000:0101,2a0b:f4c2:0004:0000:0000:0000:0000:0102] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 560"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522559; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0b:f4c2:0004:0000:0000:0000:0000:0103,2a0b:f4c2:0004:0000:0000:0000:0000:0104,2a0b:f4c2:0004:0000:0000:0000:0000:0105,2a0b:f4c2:0004:0000:0000:0000:0000:0106,2a0b:f4c2:0004:0000:0000:0000:0000:0107,2a0b:f4c2:0004:0000:0000:0000:0000:0108,2a0b:f4c2:0004:0000:0000:0000:0000:0109,2a0b:f4c2:0004:0000:0000:0000:0000:0110,2a0c:2500:0571:0f6b:5c32:be4f:2396:462f,2a0c:2500:0571:0f6b:60e4:ae26:07a8:0928] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 561"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522560; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0c:8900:0002:0b2f:0000:0000:0000:0001,2a0c:8fc0:9ae2:0000:0000:0000:0000:0001,2a0c:b641:03a1:1002:0000:0000:0000:0f28,2a0c:b641:03a1:1002:0000:0000:0000:0f3a,2a0c:b641:03a1:1002:0000:0000:0000:0ff5,2a0c:b641:03a1:1004:0000:0000:0000:012b,2a0c:b641:06f1:0148:0000:0000:0000:0002,2a0c:d480:c1c1:1286:0000:0000:0000:3458,2a0c:d480:c1c1:1286:ffff:ffff:ffff:0ffe,2a0c:e300:0000:0000:0000:0000:0000:0023] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 562"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522561; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0c:e303:0000:4de7:0000:0000:0001:0001,2a0c:e303:0000:4de7:0000:0000:0001:0002,2a0c:fe80:2000:1337:0000:0000:0000:0070,2a0d:3e83:0001:b284:0000:0000:0000:0001,2a0d:5440:0000:0000:0000:0000:0000:0025,2a0d:5940:0038:0089:0000:0000:0000:0000,2a0d:5940:0042:00f5:0000:0000:0000:0000,2a0d:5940:0090:0000:0000:0000:0000:0002,2a0d:8140:0000:0007:0000:0000:0000:004d,2a0d:c2c0:0001:0004:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 563"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522562; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0e:0dc0:0002:c588:0000:0000:0000:0001,2a0e:0dc0:0003:5b35:0000:0000:0000:d0d0,2a0e:1580:1000:0000:0000:2dff:fe0e:e997,2a0e:1580:1000:0000:0000:2dff:fe0e:e9be,2a0e:1580:1000:0000:0000:2dff:fe0e:e9c1,2a0e:1580:1000:0000:0000:2dff:fe0e:e9cd,2a0e:1580:1000:0000:0000:2dff:fe0e:e9d1,2a0e:1d80:0020:754c:0000:0000:0000:0001,2a0e:6a80:0003:0139:0000:0000:0000:0000,2a0e:6a80:0003:0155:0000:0000:0000:0000] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 564"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522563; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0e:97c0:0000:0001:0000:0000:0000:0001,2a0e:97c0:0000:0002:0000:0000:0000:0001,2a0e:97c0:0000:0004:0000:0000:0000:0001,2a0e:97c0:03ea:0057:0000:0000:0000:0001,2a0e:97c0:0470:0000:0000:0000:0000:0030,2a0e:97c0:07d4:7f5b:be24:11ff:fe87:9b9f,2a0e:97c0:0ac0:b00b:b00b:b00b:1799:6415,2a0e:97c0:0ac0:b00b:b00b:b00b:2b13:47d8,2a0e:97c0:0ac0:b00b:b00b:b00b:35d6:c603,2a0e:97c0:0ac0:b00b:b00b:b00b:3df3:1a08] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 565"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522564; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0e:97c0:0ac0:b00b:b00b:b00b:457f:7051,2a0e:97c0:0ac0:b00b:b00b:b00b:67c1:72eb,2a0e:97c0:0ac0:b00b:b00b:b00b:9fab:9633,2a0e:97c0:0ac0:b00b:b00b:b00b:b55d:ccc5,2a0e:97c0:0ac0:b00b:b00b:b00b:c779:f488,2a0e:97c0:0ac0:b00b:b00b:b00b:d44e:e7ee,2a0e:b107:0dd0:0000:0000:0003:ed78:7632,2a0e:cb80:0009:0018:0000:0000:0000:0000,2a0e:d602:0001:14bc:0000:0000:0000:0002,2a0e:d602:0002:02a2:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 566"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522565; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0e:d602:0002:055f:0000:0000:0000:0002,2a0e:e080:8007:9c00:9209:d0ff:fe19:18df,2a0e:e701:1198:0000:0000:0000:0000:0001,2a0e:f0c1:0000:2258:0000:0000:0000:0100,2a0e:fa00:0000:00d0:0000:0000:0000:0001,2a0e:fd40:0103:0158:0b19:beef:cafe:1337,2a0e:fd40:0103:0172:0000:0000:0000:0001,2a0f:5707:aaf1:031c:0000:0000:0000:0001,2a0f:5707:aaf1:0408:0000:0000:0000:0001,2a0f:5707:aaf1:1d7a:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 567"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522566; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0f:5f40:0001:0001:0000:0000:0000:015a,2a0f:5f40:0001:0001:0000:0000:0000:01f0,2a0f:6b40:0003:0000:0000:0000:0000:3700,2a0f:85c1:0356:100f:0000:0000:0000:0001,2a0f:85c1:0356:197a:0000:0000:0000:0001,2a0f:85c1:0356:578f:0000:0000:0000:0001,2a0f:93c1:0026:01f2:0000:0000:0000:9ce5,2a0f:ca80:0000:e57f:0000:0000:0785:2099,2a0f:ca80:0000:e57f:0000:0000:0834:1569,2a0f:ca80:1337:0000:0000:0000:9969:dc10] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 568"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522567; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0f:ca80:1337:0000:0000:0000:acea:135a,2a0f:ca80:1337:0000:0000:0000:c43b:17bb,2a0f:cdc6:0500:05b1:0000:0000:0000:0002,2a0f:df00:0000:0255:0000:0000:0000:0194,2a0f:df00:0000:0255:0000:0000:0000:0195,2a0f:df00:0000:0255:0000:0000:0000:0196,2a0f:df00:0000:0255:0000:0000:0000:0197,2a0f:df00:0000:0255:0000:0000:0000:0198,2a0f:df00:0000:0255:0000:0000:0000:0199,2a0f:df00:0000:0255:0000:0000:0000:0200] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 569"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522568; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0f:df00:0000:0255:0000:0000:0000:0201,2a0f:df00:0000:0255:0000:0000:0000:0202,2a0f:df00:0000:0255:0000:0000:0000:0203,2a0f:df00:0000:0255:0000:0000:0000:0204,2a0f:df00:0000:0255:0000:0000:0000:0205,2a0f:df00:0000:0255:0000:0000:0000:0206,2a0f:e586:000f:000f:0000:0000:0000:0088,2a0f:e586:000f:000f:0000:0000:0000:0133,2a0f:e586:000f:000f:0000:0000:0000:0180,2a0f:e586:000f:000f:0000:0000:0000:0182] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 570"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522569; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a0f:e586:000f:000f:0000:0000:0000:0188,2a0f:e586:000f:000f:0000:0000:0000:0202,2a0f:e586:000f:000f:9491:941d:caf5:50e7,2a0f:e586:000f:000f:baa4:d491:90be:dca5,2a0f:e586:000f:000f:c94a:de42:aac1:9045,2a10:1fc0:0001:0000:0000:0000:59a9:4a8a,2a10:1fc0:0001:0000:0000:0000:f4b3:a737,2a10:1fc0:0008:0000:0000:0000:a38c:7e20,2a10:1fc0:000d:0000:0000:0000:1697:9156,2a10:3781:001f:0000:0000:0000:0000:0005] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 571"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522570; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a10:3781:0116:0001:00ff:60ff:fe1e:4473,2a10:3781:0159:0001:0211:32ff:fec1:2fad,2a10:3781:222b:0084:0000:0000:0000:0003,2a10:3781:29b6:0000:0000:0000:0000:0003,2a10:46c0:0000:0002:0000:0000:0000:0013,2a10:8a40:f313:0000:0000:0000:0000:0029,2a10:9100:0003:0000:0000:0000:0000:1411,2a10:c800:0001:9cc6:0000:0000:0000:0001,2a10:c800:0001:f7f8:0000:01ce:01ce:babe,2a11:0840:0051:001b:0000:0000:5b43:19b6] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 572"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522571; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a11:6100:0000:0022:a236:9fff:fe9e:36ea,2a12:1e01:0000:0000:0000:0000:0000:0002,2a12:5940:13e2:0000:0000:0000:0000:0002,2a12:5940:144f:0000:0000:0000:0000:0002,2a12:5940:48a5:0000:0000:0000:0000:0002,2a12:5940:52c2:0000:0000:0000:0000:0002,2a12:5940:9101:0000:0000:0000:0000:0002,2a12:5940:b4db:0000:0000:0000:0000:0002,2a12:5940:b4dd:0000:0000:0000:0000:0002,2a12:5940:c814:0000:0000:0000:0000:0002] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 573"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522572; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a12:5940:c826:0000:0000:0000:0000:0002,2a12:5940:f0a8:0000:0000:0000:0000:0002,2a12:5e40:0001:2be7:e506:4721:0cc8:a36e,2a12:8641:0003:0012:0000:0000:0000:0000,2a12:8641:0003:0024:0000:0000:0000:0000,2a12:a800:0002:0001:0045:0138:0016:0093,2a12:a800:0002:0001:0045:0138:0016:0203,2a12:bec0:008a:0050:0000:0000:0000:0020,2a12:bec0:020b:a9bb:0000:0000:0000:0001,2a12:bec0:020b:da62:0000:0000:0000:0001] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 574"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522573; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a12:bec0:020c:94bb:0000:0000:0000:0001,2a12:bec0:0430:0002:0000:0000:0000:0002,2a12:bec0:0540:006e:0000:0000:0000:000a,2a12:bec0:0540:007b:0000:0000:0000:000a,2a12:bec0:0540:010d:0000:0000:0000:000a,2a12:d8c0:109a:9001:0000:0000:0000:0007,2a12:de40:0027:0007:0000:0000:0000:000a,2a12:de40:0027:0013:0000:0000:0000:000a,2a12:de40:0027:0014:0000:0000:0000:000a,2a12:de40:0036:02a8:0000:0000:0000:0000] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 575"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522574; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [2a13:6304:0000:0009:0000:0000:0000:0001,2a13:9f40:0000:0007:0000:0000:0000:000a,2a13:9f40:0000:0024:0000:0000:0000:000a,2a13:d200:0009:0040:0000:0000:0000:b8fd,2a14:07c2:153e:0000:0000:0000:0000:0001,31.11.200.104,31.13.195.248,31.133.0.141,31.133.1.108,31.14.252.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 576"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522575; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [31.164.215.246,31.164.230.135,31.170.22.199,31.171.154.162,31.171.154.165,31.171.154.173,31.17.25.176,31.17.39.221,31.19.10.23,31.207.89.76] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 577"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522576; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [31.21.135.233,3.121.167.65,31.214.144.175,31.220.74.133,31.220.74.30,31.220.85.162,3.129.234.3,31.42.186.165,31.43.153.208,31.49.16.171] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 578"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522577; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [3.17.205.125,3.20.179.249,3.224.74.192,3.225.115.238,35.131.69.148,35.133.154.83,35.182.71.209,37.114.35.73,37.114.53.197,37.114.53.201] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 579"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522578; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.114.53.44,37.114.57.163,37.114.57.182,37.120.144.222,37.120.160.105,37.120.162.222,37.120.165.175,37.120.168.19,37.120.171.188,37.120.171.230] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 580"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522579; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.120.174.249,37.120.178.238,37.120.183.47,37.120.185.171,37.120.186.122,37.120.186.229,37.120.187.104,37.120.190.6,37.120.194.126,37.1.204.243] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 581"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522580; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.138.39.193,37.143.61.132,37.148.223.249,37.187.103.54,37.187.122.8,37.187.147.119,37.187.2.229,37.187.23.232,37.187.2.76,37.187.4.174] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 582"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522581; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.187.76.170,37.187.96.84,37.200.99.251,37.205.8.191,37.205.9.131,37.218.242.26,37.218.245.79,37.221.127.115,37.221.192.121,37.221.193.44] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 583"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522582; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.221.195.103,37.221.195.19,37.221.195.23,37.221.196.71,37.221.197.245,37.221.212.147,37.221.66.4,37.228.129.163,37.228.129.164,37.228.129.29] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 584"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522583; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.230.128.62,37.235.48.247,37.235.49.138,37.252.187.14,37.252.190.176,37.252.191.4,37.252.191.41,37.252.254.33,37.252.255.135,37.26.77.247] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 585"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522584; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.27.106.25,37.27.18.214,37.27.2.141,37.27.25.133,37.27.29.144,37.27.30.181,37.27.42.112,37.27.42.145,37.27.58.206,37.27.67.176] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 586"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522585; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.27.70.253,37.27.8.223,37.46.208.113,37.48.120.196,37.48.120.47,37.48.90.84,37.59.29.77,37.60.243.121,37.75.166.126,37.97.185.116] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 587"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522586; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [37.97.2.201,38.102.84.190,38.102.84.204,38.102.84.24,38.103.195.2,38.130.125.47,38.132.178.154,38.147.122.250,38.147.122.251,38.147.122.252] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 588"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522587; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [38.147.122.253,38.147.122.254,38.15.129.34,38.15.129.35,38.15.129.36,38.15.129.37,38.15.129.38,38.15.131.66,38.15.131.67,38.15.131.68] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 589"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522588; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [38.15.131.69,38.15.131.70,38.154.239.242,38.154.239.250,38.154.240.58,38.175.192.191,38.175.192.7,38.175.197.42,38.175.197.45,38.175.201.167] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 590"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522589; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [38.175.201.73,38.180.23.25,38.180.88.241,38.22.136.215,38.242.234.161,38.242.238.206,38.242.240.145,38.42.21.237,38.45.66.235,38.45.67.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 591"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522590; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [38.47.53.157,38.6.224.183,38.97.116.242,38.97.116.243,40.130.207.245,42.188.99.197,43.252.37.14,45.10.24.189,45.125.166.58,45.128.133.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 592"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522591; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.128.153.6,45.128.153.72,45.128.153.74,45.128.225.77,45.128.232.124,45.128.232.132,45.128.232.137,45.128.232.140,45.128.232.158,45.128.232.5] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 593"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522592; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.128.232.69,45.128.232.77,45.129.182.225,45.129.199.211,45.13.104.185,45.131.138.227,45.132.245.7,45.132.247.155,45.134.226.157,45.134.39.88] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 594"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522593; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.135.163.24,45.136.28.24,45.136.29.221,45.136.31.178,45.137.100.160,45.138.16.93,45.138.53.239,45.139.163.63,45.139.163.75,45.140.143.145] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 595"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522594; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.140.183.80,45.141.0.102,45.141.153.214,45.141.157.50,45.141.57.69,45.142.100.30,45.142.176.108,45.142.176.32,45.142.177.89,45.142.214.40] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 596"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522595; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.142.232.203,45.14.233.151,45.14.233.190,45.14.233.193,45.14.233.205,45.14.233.209,45.144.240.19,45.144.240.191,45.145.166.104,45.145.40.181] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 597"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522596; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.147.7.119,45.148.120.162,45.148.121.112,45.148.122.114,45.149.186.133,45.150.108.105,45.15.16.197,45.154.28.70,45.155.126.164,45.158.77.241] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 598"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522597; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.158.77.29,45.159.250.25,45.249.101.87,45.32.4.66,45.32.81.8,45.33.114.120,45.33.124.98,45.33.55.238,45.33.57.83,45.41.204.203] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 599"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522598; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.45.239.188,45.55.47.232,45.61.134.213,45.61.185.134,45.61.185.194,45.61.187.139,45.61.187.249,45.61.188.195,45.63.15.42,45.66.35.11] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 600"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522599; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.66.43.3,45.67.219.13,45.67.35.38,45.72.179.134,45.73.2.211,45.76.2.145,45.76.48.130,45.76.84.56,45.76.86.86,45.77.112.107] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 601"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522600; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.77.136.58,45.77.149.17,45.77.173.141,45.79.181.228,45.79.76.174,45.79.95.244,45.80.168.22,45.80.171.18,45.80.171.95,45.80.208.110] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 602"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522601; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.80.210.20,45.8.144.90,45.82.121.246,45.82.122.254,45.82.167.158,45.82.167.175,45.83.105.223,45.83.106.19,45.83.106.225,45.83.234.114] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 603"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522602; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.83.5.242,45.85.117.23,45.85.117.38,45.85.218.62,45.85.88.117,45.86.125.102,45.86.209.201,45.86.86.158,45.86.86.165,45.86.86.231] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 604"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522603; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.89.127.221,45.89.54.11,45.89.55.108,45.89.55.34,45.90.4.235,45.91.101.227,45.91.92.40,45.92.11.136,45.92.238.246,45.92.33.62] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 605"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522604; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [45.92.33.74,45.92.70.126,45.93.9.212,45.94.31.54,45.95.169.164,45.9.60.140,46.101.165.197,46.101.178.190,46.10.211.74,46.105.29.246] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 606"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522605; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.105.91.78,46.140.63.66,46.142.146.242,46.142.50.177,46.142.64.188,46.148.21.35,46.148.21.67,46.148.26.44,46.163.76.170,46.165.221.207] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 607"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522606; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.165.242.86,46.165.252.48,46.165.253.196,46.165.254.40,46.166.165.116,46.17.63.214,46.17.96.130,46.183.217.105,46.20.35.112,46.20.35.116] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 608"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522607; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.212.254.3,46.22.165.111,46.22.212.230,46.223.45.59,46.226.104.31,46.226.105.136,46.226.105.163,46.226.106.182,46.226.107.215,46.226.111.65] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 609"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522608; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.228.199.128,46.229.55.118,46.229.8.87,46.23.108.248,46.231.240.77,46.231.93.216,46.232.248.143,46.232.250.163,46.232.250.51,46.232.251.46] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 610"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522609; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.23.72.81,46.23.92.80,46.23.94.167,46.244.237.128,46.246.126.62,46.246.44.53,46.248.185.236,46.252.9.190,46.28.109.231,46.29.234.27] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 611"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522610; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.29.235.71,46.29.235.79,46.29.250.27,46.38.236.250,46.38.237.221,46.38.237.49,46.38.238.73,46.38.242.125,46.38.242.228,46.38.253.161] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 612"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522611; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.38.254.168,46.38.255.10,46.4.103.29,46.41.148.75,46.4.183.104,46.4.32.184,46.4.34.242,46.4.57.75,46.4.66.178,46.4.66.188] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 613"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522612; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [46.4.78.3,46.4.92.139,46.4.96.24,46.5.43.161,46.59.195.164,46.63.120.248,46.7.38.176,47.145.30.165,47.150.48.104,47.160.101.93] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 614"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522613; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [47.181.193.168,47.184.33.254,47.220.228.121,47.245.106.151,49.12.224.203,49.12.230.234,49.12.5.31,49.12.57.133,49.12.80.147,49.12.93.240] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 615"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522614; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [49.13.10.149,49.13.207.32,49.13.28.37,49.13.4.123,49.13.5.150,49.13.54.48,49.13.76.37,49.13.84.173,49.13.95.189,49.150.150.225] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 616"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522615; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [49.190.47.144,49.245.108.0,49.49.30.114,50.109.239.144,50.115.171.17,50.116.35.204,50.116.39.253,50.116.51.101,50.118.225.160,50.118.225.161] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 617"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522616; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [50.118.225.183,50.120.70.143,50.21.186.234,50.230.231.84,50.230.231.85,50.5.65.128,50.64.108.115,50.65.178.92,50.7.115.67,50.7.124.35] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 618"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522617; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [50.7.14.36,50.7.14.40,50.7.178.34,50.83.36.229,5.104.111.208,5.104.75.141,5.104.87.41,51.148.150.203,51.15.108.12,51.15.116.168] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 619"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522618; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.15.150.228,51.15.232.19,51.15.243.22,51.15.246.170,51.15.36.183,51.15.37.100,51.15.40.38,51.15.4.202,51.15.44.251,51.15.49.143] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 620"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522619; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.15.50.36,51.15.52.16,51.15.54.117,51.15.75.120,51.15.76.56,51.15.79.105,51.158.116.203,51.158.145.227,51.158.146.152,51.158.146.58] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 621"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522620; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.158.153.84,51.158.154.112,51.158.201.235,51.158.238.104,51.15.89.200,51.15.89.218,51.159.153.241,51.159.171.180,51.159.176.184,51.159.179.214] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 622"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522621; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.159.181.146,51.159.186.85,51.159.195.41,51.159.211.57,51.159.34.131,51.15.95.231,51.159.59.187,51.15.96.2,51.161.202.0,51.161.203.115] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 623"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522622; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.161.35.113,51.175.94.207,51.178.131.200,51.178.140.180,51.178.82.201,51.195.121.102,51.195.130.203,51.195.152.241,51.195.41.1,51.195.41.230] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 624"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522623; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.195.43.58,51.210.103.252,51.210.111.103,51.210.148.166,51.210.181.252,51.222.110.143,51.222.140.58,51.222.15.200,51.222.207.61,51.222.24.62] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 625"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522624; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.12.224.196,51.241.180.104,51.254.96.208,5.135.156.12,5.135.162.49,5.135.177.217,5.135.182.131,5.135.199.11,5.135.83.4,51.38.110.234] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 626"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522625; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.38.113.254,51.38.235.40,51.38.54.48,51.38.65.160,5.1.56.52,5.161.127.217,5.161.187.129,5.161.60.61,5.161.76.226,5.161.84.59] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 627"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522626; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.68.136.44,51.68.152.89,51.68.155.201,51.68.185.82,51.68.197.220,51.68.199.241,51.68.204.139,51.68.231.5,51.68.45.22,5.172.132.104] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 628"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522627; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.75.129.204,51.75.153.22,51.75.171.136,51.75.206.12,51.75.70.246,51.75.71.108,51.77.126.88,51.77.210.24,51.77.245.242,51.77.67.232] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 629"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522628; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.77.71.247,51.77.90.246,5.178.67.57,51.79.156.173,51.79.221.8,51.79.65.244,51.79.67.109,51.79.71.20,5.180.253.35,5.181.134.99] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 630"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522629; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.81.155.228,51.81.155.229,51.81.155.81,5.181.158.12,5.181.158.232,5.181.158.49,51.81.201.207,51.81.208.163,51.81.208.164,51.81.208.217] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 631"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522630; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.81.209.101,51.81.209.115,51.81.209.9,51.81.242.11,51.81.245.149,51.81.254.15,5.181.51.51,5.181.51.52,5.181.51.57,51.81.56.136] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 632"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522631; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.81.56.228,51.81.56.229,51.81.56.74,51.81.56.91,51.81.57.125,5.181.80.101,5.181.80.131,5.181.80.169,5.181.80.181,5.181.80.63] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 633"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522632; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.81.93.108,51.81.93.109,51.81.93.145,51.81.93.162,51.81.93.37,51.81.93.39,51.83.132.103,51.83.185.123,51.83.237.59,51.89.106.29] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 634"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522633; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.189.134.99,5.189.155.39,51.89.17.143,5.189.181.61,51.89.242.29,51.89.242.31,5.189.253.159,51.89.2.63,51.89.40.51,51.89.81.247] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 635"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522634; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [51.91.99.150,5.196.4.91,5.196.64.99,5.196.70.226,5.196.71.24,5.196.95.16,5.199.162.114,5.199.162.155,5.199.162.73,52.205.15.239] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 636"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522635; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [52.214.94.163,5.22.159.135,5.230.119.38,52.47.91.150,5.250.184.43,5.250.185.192,5.250.186.160,5.250.191.234,5.252.176.19,5.252.178.224] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 637"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522636; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.252.224.115,5.252.225.194,5.252.226.201,52.52.230.13,5.252.74.238,5.253.176.99,5.253.84.137,5.253.84.142,5.254.118.189,5.254.118.191] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 638"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522637; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.254.118.192,5.255.101.24,5.255.102.43,5.255.104.239,5.255.106.75,5.255.108.59,5.255.109.214,5.255.110.89,5.255.111.104,5.255.111.134] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 639"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522638; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.255.112.208,5.255.116.53,5.255.88.102,5.255.96.218,5.255.97.50,5.255.98.121,5.255.98.186,5.2.70.140,5.2.78.126,52.8.68.153] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 640"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522639; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.34.176.183,5.34.176.184,5.35.103.107,5.35.103.36,5.35.103.92,5.39.185.164,5.39.81.102,54.213.206.148,54.36.162.254,54.36.191.46] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 641"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522640; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [54.36.205.38,54.36.99.69,54.37.139.118,54.37.229.22,54.37.39.31,54.38.184.55,54.38.215.74,54.38.241.3,54.38.33.66,54.38.72.170] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 642"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522641; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [54.39.118.29,54.39.234.91,54.39.68.9,54.39.73.124,5.44.101.19,5.45.104.116,5.45.104.89,5.45.105.12,5.45.111.149,5.45.98.188] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 643"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522642; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [54.87.135.234,54.93.77.70,5.56.198.130,5.56.216.42,57.128.101.155,57.128.169.164,57.128.176.177,57.128.195.50,57.129.16.194,57.129.32.225] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 644"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522643; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.75.177.223,5.75.230.210,5.75.249.160,5.78.65.159,5.78.67.126,5.78.71.16,5.78.86.16,58.107.82.46,58.153.208.244,58.179.75.194] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 645"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522644; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [58.185.69.242,58.185.69.245,5.83.178.91,58.69.164.178,59.115.188.82,5.9.121.207,5.9.122.206,5.9.137.167,5.9.14.25,5.9.14.30] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 646"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522645; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [5.9.156.17,59.187.250.174,59.21.92.113,5.9.240.66,5.9.240.67,5.9.240.68,5.9.240.69,5.9.240.70,5.9.24.169,5.9.251.179] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 647"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522646; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [59.29.233.133,5.9.56.249,5.9.59.103,5.9.66.94,5.9.80.252,59.94.137.164,60.241.48.194,60.67.211.123,61.228.214.132,61.4.102.51] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 648"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522647; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [62.101.228.30,62.102.148.185,62.112.10.154,62.112.9.92,62.113.211.114,62.113.214.74,62.141.36.150,62.141.37.218,62.141.48.175,62.141.48.177] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 649"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522648; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [62.144.51.203,62.149.2.188,62.151.180.251,62.168.3.212,62.169.19.54,62.171.142.3,62.171.148.255,62.182.84.241,62.202.20.22,62.210.105.46] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 650"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522649; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [62.210.116.61,62.210.123.24,62.210.125.130,62.210.127.37,62.210.205.228,62.210.231.115,62.210.97.21,62.216.85.210,62.224.245.236,62.30.18.19] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 651"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522650; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [62.38.144.238,62.4.14.52,62.63.203.157,62.67.28.110,62.67.28.2,62.67.28.50,62.72.44.187,62.72.46.150,62.72.82.232,63.141.233.118] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 652"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522651; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [63.141.234.37,63.141.234.38,63.227.116.162,63.250.63.173,64.135.129.118,64.176.10.122,64.176.10.216,64.176.11.159,64.176.210.130,64.176.58.60] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 653"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522652; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [64.223.149.100,64.226.23.78,64.227.119.130,64.227.39.180,64.233.157.199,64.251.255.9,64.31.10.6,64.31.22.133,64.31.22.195,64.31.22.201] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 654"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522653; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [64.31.53.96,64.31.55.211,64.31.55.212,64.31.55.213,64.42.176.50,64.44.51.37,64.52.108.69,64.98.115.32,64.98.123.11,65.108.108.198] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 655"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522654; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.108.129.218,65.108.136.183,65.108.136.189,65.108.136.190,65.108.144.101,65.108.195.151,65.108.217.34,65.108.222.42,65.108.231.17,65.108.233.166] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 656"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522655; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.108.3.114,65.108.74.41,65.108.77.19,65.108.89.113,65.109.0.210,65.109.109.232,65.109.115.38,65.109.120.23,65.109.13.155,65.109.161.207] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 657"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522656; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.109.230.157,65.109.233.53,65.109.26.110,65.109.26.84,65.109.26.85,65.109.26.86,65.109.26.89,65.109.30.253,65.109.65.38,65.109.65.57] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 658"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522657; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.109.65.59,65.109.67.140,65.109.67.160,65.109.67.182,65.109.84.122,65.109.93.180,65.109.98.156,65.129.117.48,65.20.112.134,65.20.77.217] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 659"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522658; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.21.0.217,65.21.110.38,65.21.115.34,65.21.115.35,65.21.115.38,65.21.1.225,65.21.163.2,65.21.163.3,65.21.163.4,65.21.163.5] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 660"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522659; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.21.163.6,65.21.164.50,65.21.164.52,65.21.164.53,65.21.180.151,65.21.187.86,65.21.1.92,65.21.195.87,65.21.246.132,65.21.49.9] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 661"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522660; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [65.21.54.19,65.21.85.98,65.21.94.13,65.24.242.46,65.39.97.13,65.49.20.10,65.49.20.11,65.49.20.12,66.103.204.121,66.111.2.131] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 662"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522661; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [66.111.2.16,66.111.2.20,66.165.227.138,66.165.241.228,66.165.241.230,66.169.194.135,66.175.235.244,66.179.251.201,66.183.173.29,66.187.4.132] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 663"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522662; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [66.206.1.202,66.29.156.107,66.29.156.109,66.29.156.127,66.42.100.169,66.42.70.233,66.42.99.190,66.52.155.5,66.70.227.44,66.78.40.101] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 664"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522663; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [66.85.128.218,67.159.26.2,67.170.248.37,67.205.139.175,67.205.165.67,67.205.180.87,67.207.73.55,67.213.221.16,67.215.31.170,67.219.107.200] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 665"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522664; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [67.4.139.248,67.81.164.65,68.134.176.234,68.148.174.117,68.171.179.124,68.183.163.215,68.183.182.89,68.183.78.172,68.199.157.117,68.235.157.220] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 666"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522665; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [68.238.62.38,68.253.253.66,68.67.32.31,68.67.32.32,68.67.32.33,68.67.32.34,68.71.25.194,68.8.241.30,68.96.115.95,68.97.244.129] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 667"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522666; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [69.120.194.133,69.147.200.219,69.164.210.140,69.164.211.18,69.166.182.51,69.197.160.206,69.209.101.212,69.237.207.60,69.30.239.126,70.175.76.239] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 668"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522667; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [70.19.40.203,70.32.193.177,70.34.215.210,70.34.222.94,70.34.244.156,70.34.250.156,70.34.254.192,70.52.96.107,70.63.170.86,71.105.213.33] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 669"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522668; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [71.114.77.56,71.182.176.80,71.19.144.41,71.19.146.15,71.19.148.104,71.19.149.21,71.19.157.127,71.214.163.190,71.235.16.49,71.244.170.31] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 670"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522669; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [71.34.68.158,71.42.125.218,71.60.146.138,71.84.116.82,72.167.47.69,72.2.129.156,72.49.197.25,72.83.250.130,72.89.162.43,72.89.51.17] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 671"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522670; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [73.110.236.34,73.113.211.213,73.117.132.138,73.121.192.172,73.121.197.64,73.136.66.7,73.140.189.95,73.157.43.236,73.174.238.50,73.18.130.34] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 672"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522671; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [73.254.22.49,73.60.21.174,73.90.104.154,73.92.207.232,73.95.217.197,74.105.68.233,74.106.232.4,74.116.186.120,74.118.77.34,74.123.97.10] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 673"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522672; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [74.123.97.26,74.123.98.10,74.123.98.18,74.14.22.207,74.207.253.212,74.208.104.100,74.208.142.142,74.208.182.78,74.208.189.124,74.208.201.163] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 674"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522673; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [74.208.209.29,74.208.27.90,74.208.29.99,74.208.45.216,74.208.60.50,74.208.88.184,74.215.154.5,74.50.98.172,74.50.99.117,74.63.194.162] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 675"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522674; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [74.63.194.176,74.63.247.219,74.63.247.232,74.91.26.170,74.91.27.30,75.145.166.77,75.157.141.153,75.176.43.62,75.223.104.68,75.223.61.243] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 676"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522675; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [75.68.155.99,75.75.102.102,75.87.175.126,76.10.157.54,76.192.65.169,76.204.63.172,76.252.151.48,76.97.8.196,77.10.133.70,77.105.107.21] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 677"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522676; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.109.112.114,77.109.152.148,77.109.152.87,77.160.53.97,77.162.229.73,77.172.70.151,77.174.164.37,77.174.62.158,77.181.118.124,77.191.56.208] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 678"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522677; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.22.52.52,77.22.59.144,77.237.233.50,77.237.246.219,77.237.52.14,77.253.223.171,77.3.180.219,77.32.108.46,77.37.3.7,77.48.28.240] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 679"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522678; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.68.111.120,77.68.20.86,77.68.30.104,77.68.67.193,77.73.69.128,77.73.70.167,77.74.96.43,77.83.198.149,77.83.198.213,77.8.45.157] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 680"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522679; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [77.91.74.149,78.135.88.66,78.138.98.42,78.141.211.177,78.141.211.44,78.159.117.165,78.194.158.30,78.196.33.136,78.203.245.37,78.31.228.154] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 681"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522680; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [78.31.64.196,78.31.67.22,78.33.99.62,78.43.117.254,78.46.120.54,78.46.123.26,78.46.162.123,78.46.193.215,78.46.209.112,78.47.14.99] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 682"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522681; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [78.47.161.178,78.47.169.189,78.47.189.21,78.47.209.122,78.47.209.123,78.47.209.124,78.47.209.125,78.47.209.126,78.47.32.42,78.47.39.90] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 683"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522682; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [78.47.43.253,78.48.121.74,78.61.137.118,78.66.132.27,78.67.129.67,78.80.47.85,78.94.30.84,78.98.56.210,79.107.232.138,79.110.193.183] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 684"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522683; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [79.114.170.106,79.116.151.228,79.116.19.84,79.117.125.240,79.118.204.124,79.119.54.37,79.124.7.11,79.124.8.135,79.137.202.92,79.140.184.201] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 685"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522684; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [79.141.165.172,79.141.174.124,79.141.175.229,79.143.177.192,79.158.130.34,79.185.201.139,79.191.192.23,79.192.123.55,79.201.243.98,79.20.36.78] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 686"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522685; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [79.206.34.134,79.207.98.228,79.211.33.133,79.212.30.192,79.223.181.93,79.225.122.161,79.23.143.89,79.236.207.223,79.241.239.182,79.24.185.36] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 687"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522686; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [79.24.91.240,79.254.166.251,79.30.144.186,79.36.167.2,79.44.215.145,79.57.55.161,79.57.55.162,79.57.55.165,79.57.55.166,80.108.10.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 688"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522687; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [80.109.197.24,80.121.146.115,80.129.27.193,80.133.215.149,80.138.192.96,80.145.99.120,80.147.33.157,80.151.220.220,80.151.36.96,80.211.130.241] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 689"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522688; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [80.211.240.153,80.211.74.173,80.221.56.249,80.241.214.102,80.241.217.52,80.241.220.57,80.49.169.159,80.64.181.152,80.66.135.123,80.67.167.86] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 690"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522689; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [80.71.227.188,80.92.204.251,80.96.156.59,81.0.31.238,81.109.85.125,81.153.112.22,81.161.238.136,81.161.238.51,81.161.238.57,81.16.33.38] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 691"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522690; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [81.164.204.205,81.166.83.239,81.169.134.23,81.169.166.81,81.169.186.16,81.169.222.158,81.169.240.172,81.169.240.47,81.17.28.117,81.17.30.48] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 692"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522691; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [81.173.139.203,81.17.60.24,81.182.253.73,81.201.202.101,81.2.191.169,81.2.191.34,81.230.230.107,81.230.245.67,81.235.144.114,81.44.126.2] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 693"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522692; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [81.56.176.71,81.6.47.149,81.7.10.19,81.7.10.193,81.7.14.253,81.7.16.177,81.7.18.7,81.7.18.96,81.9.139.136,81.95.11.117] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 694"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522693; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [81.98.64.85,82.118.21.80,82.118.23.198,82.118.242.103,82.118.242.226,82.130.23.221,82.135.70.168,82.147.159.65,82.149.227.123,82.149.227.124] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 695"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522694; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.149.227.125,82.149.227.126,82.149.227.236,82.152.54.194,82.152.54.195,82.152.54.196,82.152.54.197,82.152.54.198,82.152.54.199,82.152.54.200] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 696"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522695; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.152.54.201,82.152.54.202,82.152.54.203,82.153.138.209,82.153.138.81,82.165.101.234,82.165.116.173,82.165.177.112,82.165.201.150,82.165.201.185] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 697"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522696; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.165.20.161,82.165.206.196,82.165.244.94,82.165.34.36,82.165.70.65,82.165.76.126,82.165.77.33,82.168.32.82,82.168.62.152,82.172.182.1] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 698"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522697; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.196.11.10,82.197.160.67,82.220.38.150,82.221.141.27,82.223.114.35,82.223.1.192,82.223.165.239,82.223.70.114,82.33.84.2,82.36.133.46] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 699"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522698; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.43.196.64,82.48.228.50,82.64.135.138,82.64.20.171,82.64.238.84,82.64.243.112,82.64.46.143,82.64.75.232,82.65.123.107,82.65.150.138] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 700"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522699; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [82.65.165.202,82.65.217.155,82.66.130.173,82.66.197.211,82.66.249.246,82.66.255.188,82.66.36.3,82.66.61.19,82.68.0.77,82.94.251.227] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 701"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522700; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [83.0.60.229,83.136.106.96,83.136.107.114,83.147.41.93,83.148.233.129,83.149.125.241,83.159.242.236,83.168.69.84,83.170.6.70,83.190.118.24] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 702"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522701; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [83.192.108.102,83.212.100.100,83.212.104.45,83.212.117.37,83.212.72.189,83.212.81.32,83.212.96.97,83.219.162.228,83.249.23.51,83.250.51.69] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 703"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522702; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [83.255.154.238,83.43.95.238,83.6.13.252,83.63.10.83,84.133.90.118,84.134.142.112,84.136.178.31,84.139.14.140,84.150.219.48,84.166.219.1] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 704"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522703; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [84.167.62.189,84.168.107.78,84.168.117.189,84.171.64.110,84.19.188.216,84.196.6.43,84.216.26.137,84.238.10.142,84.240.60.234,84.245.205.181] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 705"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522704; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [84.247.160.4,84.247.164.52,84.247.164.64,84.247.164.65,84.247.189.63,84.249.19.20,84.251.54.86,8.42.76.68,84.32.131.123,84.32.131.124] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 706"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522705; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [84.32.131.125,84.32.131.126,84.32.131.127,84.32.131.84,84.32.214.90,84.46.243.189,84.46.9.250,84.50.88.209,84.52.204.253,84.54.51.152] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 707"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522706; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [84.54.51.237,84.54.51.64,84.54.51.84,84.54.51.86,84.54.51.87,84.54.51.91,84.54.51.92,84.62.245.92,84.70.158.170,84.73.217.59] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 708"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522707; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.0.13.156,85.0.84.233,85.10.176.97,85.10.240.250,85.119.82.131,85.119.82.142,85.159.228.20,85.159.228.63,85.17.25.46,85.183.60.50] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 709"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522708; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.195.115.5,85.195.203.215,85.195.208.215,85.195.230.249,85.195.232.63,85.195.244.251,85.195.253.142,85.208.144.164,85.208.69.66,85.209.46.236] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 710"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522709; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.209.49.222,85.209.50.10,85.209.51.37,85.214.101.157,85.214.111.133,85.214.122.29,85.214.149.151,85.214.151.174,85.214.165.61,85.214.200.184] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 711"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522710; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.214.202.158,85.214.236.165,85.214.42.55,85.214.52.114,85.214.58.236,85.214.64.22,85.215.114.1,85.215.145.68,85.215.149.148,85.215.153.202] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 712"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522711; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.215.160.111,85.215.160.128,85.215.181.200,85.215.200.200,85.215.231.134,85.215.34.3,85.215.41.116,85.215.42.225,85.215.46.141,85.215.51.161] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 713"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522712; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.215.53.30,85.215.66.179,85.215.67.230,85.215.68.72,85.215.76.111,85.215.76.123,85.215.91.150,85.23.104.222,85.239.34.239,85.239.34.24] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 714"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522713; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.239.34.47,85.239.34.6,85.239.40.27,85.24.237.73,85.24.237.74,85.242.69.46,85.25.2.6,85.30.131.60,85.31.47.165,85.49.7.119] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 715"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522714; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [85.50.3.223,85.72.90.163,85.89.172.150,85.93.254.36,86.104.194.27,86.121.179.2,86.124.234.126,86.124.25.109,86.13.190.107,86.13.252.199] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 716"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522715; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [86.14.169.71,86.145.157.13,86.145.94.245,86.170.38.133,86.175.224.58,86.17.88.29,86.188.63.194,86.2.211.151,86.2.83.150,86.56.60.83] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 717"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522716; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [86.59.21.163,86.86.126.113,86.86.173.62,87.100.217.17,87.104.37.132,87.106.159.40,87.106.167.107,87.106.168.172,87.106.176.205,87.106.207.35] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 718"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522717; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [87.106.230.106,87.106.232.123,87.106.235.75,87.106.239.199,87.118.88.94,87.120.237.130,87.120.8.91,87.121.52.112,87.121.52.182,87.121.69.162] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 719"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522718; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [87.121.69.163,87.121.69.164,87.121.69.168,87.121.69.169,87.122.37.12,87.128.54.218,87.138.152.33,87.145.175.226,87.149.65.168,87.151.55.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 720"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522719; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [87.153.233.51,87.169.211.108,87.171.75.100,87.221.15.164,87.227.211.65,87.229.115.23,87.229.85.197,87.236.194.23,87.236.195.198,87.236.195.203] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 721"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522720; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [87.236.195.216,87.236.197.123,87.236.199.239,87.247.68.139,87.54.95.17,87.61.100.125,87.78.238.252,87.92.163.179,87.94.59.15,87.98.153.133] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 722"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522721; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [87.98.237.152,87.98.242.239,87.98.243.204,88.113.123.228,88.12.118.70,88.133.188.150,88.134.139.6,88.150.104.106,88.150.1.103,88.151.194.118] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 723"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522722; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [88.151.194.12,88.152.71.98,88.177.209.148,88.17.87.254,88.195.223.91,88.198.101.33,88.198.207.48,88.198.209.95,88.198.35.49,88.198.75.143] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 724"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522723; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [88.198.77.51,88.208.196.199,88.208.56.9,88.209.197.220,88.214.57.188,88.216.223.2,88.216.223.3,88.216.223.5,88.216.2.90,88.76.171.6] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 725"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522724; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [88.77.180.15,88.80.184.11,88.90.10.92,88.90.133.183,88.90.162.62,88.97.43.116,88.99.104.83,88.99.144.235,88.99.145.25,88.99.2.111] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 726"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522725; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [88.99.248.158,88.99.31.186,88.99.76.10,88.99.7.87,88.99.94.231,89.115.15.153,89.117.145.38,89.147.108.149,89.147.108.35,89.147.109.123] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 727"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522726; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.147.109.13,89.147.109.68,89.147.109.91,89.147.110.112,89.147.111.106,89.147.111.181,89.147.111.28,89.147.111.89,89.150.131.83,89.150.132.174] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 728"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522727; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.150.140.164,89.154.160.197,89.161.26.78,89.163.135.8,89.163.152.213,89.163.164.202,89.163.211.14,89.163.231.179,89.163.250.218,89.168.17.69] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 729"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522728; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.168.185.77,89.185.109.216,89.190.6.9,89.191.198.167,89.191.217.1,89.203.249.226,89.203.249.72,89.210.232.109,89.212.103.241,89.213.175.153] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 730"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522729; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.21.65.179,89.221.218.22,89.221.224.96,89.244.216.103,89.246.51.45,89.247.26.239,89.248.165.40,89.33.85.168,89.33.85.21,89.34.18.151] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 731"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522730; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.36.218.127,89.39.105.55,89.39.161.241,89.44.198.196,89.45.184.119,89.46.100.71,89.58.0.34,89.58.1.100,89.58.17.198,89.58.17.212] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 732"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522731; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.58.17.228,89.58.18.10,89.58.1.91,89.58.2.121,89.58.26.150,89.58.27.5,89.58.27.85,89.58.30.165,89.58.3.114,89.58.32.165] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 733"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522732; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.58.32.67,89.58.33.214,89.58.34.53,89.58.36.174,89.58.3.65,89.58.4.118,89.58.43.207,89.58.45.45,89.58.45.9,89.58.48.237] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 734"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522733; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.58.49.77,89.58.5.0,89.58.52.69,89.58.53.213,89.58.54.129,89.58.55.205,89.58.56.112,89.58.58.209,89.58.60.208,89.58.61.21] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 735"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522734; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [89.58.61.42,89.58.62.138,89.58.9.203,89.85.185.88,90.112.176.26,90.120.126.232,90.143.213.98,90.146.187.6,90.155.5.6,90.186.154.108] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 736"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522735; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [90.187.254.173,90.191.149.114,90.231.147.132,90.26.207.155,90.53.112.187,90.86.126.4,91.108.126.53,91.112.69.62,91.115.65.225,91.121.147.65] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 737"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522736; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.121.219.14,91.126.115.173,91.127.182.124,91.132.144.85,91.132.145.245,91.132.146.135,91.132.146.181,91.132.146.190,91.132.146.206,91.132.147.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 738"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522737; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.132.147.168,91.135.7.214,91.143.81.27,91.143.87.51,91.143.88.62,91.146.243.196,91.148.187.189,91.149.242.91,91.151.249.170,91.151.93.46] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 739"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522738; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.176.89.251,91.177.21.75,91.186.47.231,91.192.81.77,91.193.18.143,91.200.101.151,91.203.145.114,91.203.5.141,91.204.6.136,91.205.230.113] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 740"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522739; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.206.228.132,91.206.228.91,91.208.184.123,91.208.197.187,91.208.197.221,91.208.206.56,91.21.206.2,91.213.233.138,91.217.121.118,91.218.20.104] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 741"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522740; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.219.236.77,91.219.237.160,91.219.238.120,91.219.238.148,91.219.245.62,91.219.30.55,91.219.60.67,91.223.82.197,91.224.90.35,91.228.52.211] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 742"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522741; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.228.52.73,91.228.52.8,91.229.132.69,91.229.245.102,91.233.116.51,91.233.158.86,91.234.199.232,91.242.241.78,91.244.197.76,91.245.255.87] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 743"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522742; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.249.34.2,91.250.81.52,91.3.204.143,91.32.57.157,91.33.88.108,91.35.148.119,91.38.238.106,91.40.114.35,91.58.181.33,91.64.150.52] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 744"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522743; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [91.64.247.155,91.65.103.44,91.65.248.99,91.7.184.14,91.7.34.141,91.92.244.107,91.92.244.14,91.96.135.140,92.106.221.55,92.116.142.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 745"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522744; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [92.116.234.197,92.116.244.138,92.117.23.84,92.119.124.84,92.119.159.25,92.13.170.36,92.138.115.232,92.141.125.48,92.170.182.22,92.176.200.1] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 746"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522745; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [92.200.222.218,92.204.41.234,92.205.129.119,92.205.129.7,92.205.161.164,92.205.17.128,92.205.17.93,92.206.91.123,92.221.242.195,92.222.172.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 747"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522746; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [92.222.79.186,92.223.105.174,92.243.0.179,92.243.0.63,92.243.20.101,92.247.48.183,92.249.143.119,92.27.150.44,92.27.150.46,92.27.150.47] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 748"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522747; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [92.28.67.140,92.35.20.70,92.35.68.2,92.38.162.88,92.42.14.204,92.50.86.110,92.51.45.21,92.60.37.105,92.60.38.166,93.104.119.70] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 749"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522748; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.115.240.55,93.115.27.81,93.115.97.242,93.118.34.246,93.119.15.82,93.148.130.197,93.158.213.15,93.177.64.241,93.177.65.182,93.177.73.98] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 750"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522749; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.177.75.10,93.180.157.154,93.185.165.76,93.186.200.169,93.190.141.26,93.190.143.41,93.19.58.38,93.19.58.40,93.205.3.146,93.219.44.56] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 751"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522750; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.231.7.57,93.232.185.14,93.31.68.14,93.41.149.117,93.56.117.22,93.58.252.139,93.90.194.106,93.90.202.104,93.90.203.42,93.90.74.30] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 752"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522751; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.93.118.87,93.95.227.119,93.95.228.131,93.95.228.51,93.95.228.74,93.95.230.245,93.95.230.85,93.95.231.110,93.95.231.115,93.95.88.13] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 753"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522752; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [93.99.104.5,94.100.6.10,94.100.6.13,94.100.6.27,94.100.6.30,94.103.124.166,94.103.124.176,94.103.124.216,94.103.124.217,94.103.124.31] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 754"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522753; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.103.188.190,94.103.188.80,94.105.105.238,94.130.10.251,94.130.129.15,94.130.132.10,94.130.142.182,94.130.185.68,94.130.189.8,94.130.227.162] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 755"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522754; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.130.51.212,94.130.69.218,94.130.89.176,94.131.119.29,94.131.13.242,94.131.171.105,94.131.2.4,94.131.97.41,94.134.163.145,94.140.112.158] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 756"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522755; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.140.112.98,94.140.115.114,94.140.120.130,94.143.137.213,94.154.159.96,94.156.175.120,94.156.175.85,94.156.175.86,94.158.246.117,94.16.104.103] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 757"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522756; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.16.104.159,94.16.105.206,94.16.107.178,94.16.109.180,94.16.113.135,94.16.113.35,94.16.113.89,94.16.114.231,94.16.114.247,94.16.116.156] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 758"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522757; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.16.116.48,94.16.118.23,94.16.118.250,94.16.120.204,94.16.122.61,94.16.123.135,94.16.123.171,94.16.123.97,94.16.147.223,94.16.31.131] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 759"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522758; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.177.106.32,94.177.106.41,94.177.8.200,94.198.54.223,94.199.214.229,94.220.64.199,94.224.67.24,94.230.217.52,94.23.121.150,94.23.148.66] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 760"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522759; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.23.149.136,94.23.150.210,94.23.168.79,94.23.172.32,94.23.210.85,94.23.247.42,94.23.248.158,94.23.68.187,94.23.70.32,94.23.76.244] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 761"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522760; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.23.76.52,94.242.53.228,94.242.59.47,94.247.217.230,94.26.73.162,94.46.171.151,94.46.171.221,94.46.171.245,94.62.52.227,94.72.118.116] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 762"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522761; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [94.72.118.117,94.72.118.118,94.72.118.119,94.72.118.122,94.72.118.123,94.74.253.186,95.110.254.231,95.111.211.133,95.111.230.178,95.117.106.36] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 763"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522762; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.119.108.177,95.141.32.124,95.148.2.11,95.153.31.26,95.153.31.38,95.153.32.22,95.164.34.180,95.179.162.106,95.179.180.139,95.179.214.75] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 764"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522763; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.211.138.51,95.211.138.7,95.211.194.165,95.211.205.138,95.211.210.72,95.211.4.174,95.214.52.187,95.214.53.96,95.216.101.247,95.216.115.85] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 765"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522764; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.216.12.30,95.216.13.120,95.216.13.55,95.216.140.159,95.216.146.117,95.216.154.9,95.216.168.133,95.216.19.41,95.216.198.252,95.216.199.76] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 766"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522765; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.216.202.181,95.216.20.80,95.216.209.129,95.216.212.222,95.216.22.22,95.216.22.24,95.216.225.44,95.216.22.87,95.216.23.120,95.216.24.23] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 767"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522766; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.216.27.105,95.216.3.171,95.216.32.14,95.216.33.30,95.216.33.58,95.216.35.176,95.216.35.84,95.216.61.210,95.216.61.211,95.216.72.165] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 768"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522767; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.216.90.10,95.216.90.13,95.216.90.14,95.216.96.44,95.217.109.36,95.217.112.218,95.217.112.243,95.217.112.245,95.217.129.223,95.217.133.157] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 769"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522768; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.217.135.55,95.217.14.105,95.217.14.17,95.217.15.125,95.217.156.221,95.217.16.212,95.217.17.169,95.217.199.55,95.217.201.126,95.217.2.206] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 770"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522769; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.217.223.54,95.217.231.111,95.217.28.112,95.217.30.201,95.217.36.40,95.217.39.117,95.217.6.94,95.217.71.73,95.217.72.151,95.222.140.85] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 771"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522770; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [95.222.201.54,95.232.11.213,95.23.252.197,95.234.237.101,95.85.90.130,95.89.34.50,95.98.44.166,95.99.2.91,95.99.30.188,95.99.51.184] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 772"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522771; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [96.126.105.219,96.20.102.87,96.22.27.178,96.232.179.233,96.234.175.139,96.234.180.68,96.238.57.164,96.244.38.131,96.245.83.39,96.255.23.226] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 773"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522772; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [96.255.94.70,96.35.102.247,96.43.209.183,96.65.68.193,97.113.0.110,97.115.249.125,97.116.31.29,97.116.38.1,97.74.93.136,98.115.184.252] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 774"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522773; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;) alert tcp [98.115.87.163,98.121.68.25,98.128.173.1,98.128.175.41,98.128.175.45,98.128.175.69,98.155.3.106,98.165.54.32,98.168.31.145,98.206.28.99] any -> $HOME_NET any (msg:"ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 775"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/TorRules; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; flowbits:set,ET.TorIP; sid:2522774; rev:5542; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag TOR, signature_severity Informational, created_at 2008_12_01, updated_at 2024_05_31;)