#
# Emerging Threats dos rules.
#
# Rules to block C&C servers identified by Shadowserver (www.shadowserver.org)
#
# More information available at www.emergingthreats.net
#
# Please submit any feedback or ideas to emerging@emergingthreats.net or the emerging-sigs mailing list
#
#*************************************************************
#
#  Copyright (c) 2003-2012, Emerging Threats
#  All rights reserved.
#  
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the 
#  following conditions are met:
#  
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following 
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the 
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived 
#    from this software without specific prior written permission.
#  
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, 
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
#
#


# Rev 2702

table <ET> persist { 106.187.38.250 , 107.20.73.183, 108.242.100.18, 108.61.240.240, 108.62.106.222, 109.127.8.242, 109.127.8.246, 109.163.229.5, 109.163.233.22, 109.163.233.48, 109.169.58.188, 109.169.63.156, 109.169.86.176, 109.196.130.50, 109.235.253.46, 109.235.51.214, 109.73.106.6, 109.74.200.40, 109.74.206.120, 109.75.176.249, 109.75.189.82, 110.44.26.158, 111.67.13.104, 112.216.108.38, 112.220.102.35, 113.20.5.3, 113.212.96.205, 113.35.224.60, 114.108.128.35, 114.112.255.81, 114.112.255.82, 116.123.41.170, 117.20.11.38, 118.218.219.175, 119.10.181.1, 119.145.144.126, 119.59.121.67, 119.59.99.160, 119.59.99.184, 119.59.99.52, 119.92.74.58, 121.254.178.6, 122.155.18.83, 122.248.218.2, 123.252.193.141, 123.30.110.94, 123.30.129.249, 123.30.208.3, 124.248.205.107, 125.160.17.71, 125.160.17.72, 128.204.202.126, 128.204.202.151, 128.39.65.226, 128.39.65.230, 130.185.159.16, 130.237.188.216, 130.240.22.202, 134.93.159.115, 140.113.207.143, 140.122.83.196, 140.174.69.144, 141.105.66.25, 141.8.192.32, 145.24.145.228, 145.89.150.59, 146.185.249.118, 146.185.249.31, 147.8.70.240, 149.13.20.119, 149.140.119.108, 149.154.152.254, 149.154.153.61, 149.255.99.214, 149.47.133.128, 150.254.65.42, 151.13.184.200, 151.97.190.239, 154.35.136.34, 154.35.64.104, 154.35.64.107, 154.35.64.115, 154.35.64.119, 154.35.64.120, 154.35.64.123, 154.35.64.129, 154.35.64.15, 154.35.64.2, 154.35.64.30, 154.35.64.31, 154.35.64.32, 154.35.64.46, 154.35.64.50, 154.35.64.53, 154.35.64.54, 154.35.64.65, 154.35.64.70, 154.35.64.72, 154.35.64.76, 154.35.64.77, 154.35.64.78, 154.35.64.81, 154.35.64.82, 154.35.64.83, 154.35.64.85, 154.35.65.10, 158.38.8.251, 163.143.138.155, 168.150.251.54, 172.16.7.1, 173.161.28.17, 173.192.58.52, 173.208.34.240, 173.208.89.67, 173.230.253.193, 173.231.36.114, 173.244.206.120, 173.244.212.102, 173.245.201.28, 173.246.101.14, 173.246.103.92, 173.248.152.22, 173.255.206.101, 173.255.206.17, 173.255.212.165, 173.255.223.108, 173.255.236.126, 173.255.236.127, 173.44.171.98, 174.127.66.192, 174.129.242.247, 174.133.24.18, 174.136.1.54, 174.140.171.189, 174.142.48.174, 174.142.79.182, 174.34.175.241, 174.37.216.199, 174.59.20.100, 175.103.44.10, 175.41.142.106, 175.6.1.159, 176.215.68.57, 176.215.86.120, 176.28.0.135, 176.28.0.239, 176.31.119.79, 176.31.145.244, 176.31.172.1, 176.31.208.105, 176.31.239.200, 176.31.240.34, 176.31.68.31, 176.31.99.187, 176.32.75.164, 176.34.209.220, 176.9.109.86, 176.9.11.125, 176.9.142.61, 176.9.53.212, 176.9.80.5, 177.8.168.15, 177.8.168.23, 178.159.240.240, 178.162.181.39, 178.162.243.41, 178.17.166.218, 178.18.242.45, 178.208.77.211, 178.21.112.215, 178.210.66.74, 178.219.145.165, 178.237.25.134, 178.237.25.135, 178.248.85.67, 178.32.49.223, 178.32.57.57, 178.32.72.193, 178.33.116.27, 178.33.146.57, 178.33.83.58, 178.33.88.93, 178.63.103.146, 178.63.168.35, 178.63.217.181, 178.63.252.56, 178.77.76.221, 178.79.145.95, 178.79.161.168, 178.86.0.218, 183.77.207.149, 184.106.146.192, 184.107.187.26, 184.107.201.242, 184.107.220.98, 184.107.48.155, 184.154.207.58, 184.154.231.4, 184.172.165.216, 184.172.233.250, 184.72.219.59, 184.73.167.34, 184.82.162.249, 184.82.204.152, 186.112.142.106, 186.36.27.38, 188.120.242.111, 188.120.245.49, 188.120.254.193, 188.126.73.54, 188.126.73.62, 188.138.112.173, 188.165.164.16, 188.165.164.25, 188.165.217.35, 188.165.64.103, 188.165.69.143, 188.165.69.145, 188.165.69.146, 188.165.69.149, 188.165.69.150, 188.165.95.115, 188.187.160.144, 188.190.126.173, 188.190.126.175, 188.190.126.176, 188.219.154.228, 188.247.135.117, 188.247.135.53, 188.247.135.58, 188.247.135.74, 188.247.135.99, 188.40.207.188, 188.72.225.253, 188.72.238.183, 190.111.15.155, 190.120.228.216, 190.154.140.76, 190.255.181.38, 190.66.198.50, 190.96.77.94, 192.116.69.146, 192.117.148.103, 192.162.76.78, 192.176.205.54, 192.87.173.10, 193.105.240.195, 193.106.173.118, 193.106.173.134, 193.106.173.198, 193.106.175.106, 193.106.175.171, 193.106.31.12, 193.106.31.175, 193.106.31.222, 193.106.31.45, 193.106.31.74, 193.107.16.206, 193.107.16.224, 193.107.17.248, 193.107.172.11, 193.107.204.22, 193.107.204.81, 193.136.216.101, 193.161.86.43, 193.161.86.70, 193.219.61.23, 193.27.78.5, 193.39.78.193, 194.109.129.222, 194.116.174.85, 194.124.229.58, 194.124.229.59, 194.141.99.20, 194.219.29.139, 194.226.56.133, 194.28.132.125, 194.44.157.130, 194.54.81.198, 194.54.88.40, 194.8.194.65, 194.8.75.183, 195.112.224.110, 195.14.112.126, 195.14.113.194, 195.14.113.22, 195.14.113.23, 195.140.202.142, 195.146.139.60, 195.175.239.169, 195.19.104.14, 195.211.196.179, 195.214.214.53, 195.22.0.141, 195.22.174.130, 195.222.70.238, 195.225.204.21, 195.226.218.216, 195.23.131.68, 195.24.65.50, 195.28.191.146, 195.3.138.84, 195.34.133.92, 195.5.245.197, 195.54.159.109, 195.54.16.65, 195.54.209.98, 195.68.206.250, 195.78.229.104, 195.8.250.180, 195.9.14.153, 195.98.59.77, 196.34.88.5, 196.46.143.88, 198.252.144.2, 198.3.160.3, 199.115.229.192, 199.115.229.193, 199.167.193.215, 199.19.119.130, 199.19.215.29, 199.19.94.134, 199.2.137.142, 199.21.114.34, 199.59.166.89, 199.85.215.60, 200.29.0.66, 200.56.243.137, 200.58.101.71, 200.58.123.80, 200.83.0.116, 200.98.161.188, 201.208.203.202, 202.165.179.18, 202.186.124.202, 202.67.15.173, 202.75.49.166, 203.121.165.16, 203.136.50.155, 203.170.193.101, 203.170.193.23, 203.170.193.96, 203.26.195.2, 203.26.195.6, 203.27.227.92, 203.44.1.211, 203.81.204.105, 204.11.237.4, 204.12.25.7, 204.124.181.137, 204.124.181.138, 204.152.221.99, 204.188.195.22, 204.188.195.67, 204.188.195.81, 204.188.197.205, 204.188.221.157, 204.188.221.195, 204.188.245.148, 204.45.70.246, 204.45.87.149, 205.134.185.250, 205.185.113.88, 205.186.156.104, 205.201.45.29, 205.209.5.1, 205.234.197.53, 206.12.19.242, 206.214.66.76, 206.41.116.99, 206.41.117.126, 206.41.117.38, 206.41.117.68, 206.53.60.50, 207.192.69.151, 207.192.72.99, 207.46.90.178, 208.109.208.200, 208.111.35.75, 208.111.39.43, 208.116.44.116, 208.125.158.219, 208.146.35.105, 208.167.237.120, 208.185.82.133, 208.185.93.233, 208.49.56.226, 208.51.40.2, 208.91.197.134, 208.98.22.82, 208.98.41.70, 208.98.41.80, 208.98.42.73, 208.98.61.210, 208.98.9.203, 208.98.9.210, 208.99.88.240, 208.99.89.218, 209.11.244.82, 209.133.11.202, 209.135.132.62, 209.140.22.126, 209.20.76.124, 209.20.83.142, 209.20.84.48, 209.217.251.35, 209.222.22.22, 209.222.22.44, 209.236.117.75, 209.249.249.126, 209.250.254.5, 209.59.216.46, 209.59.217.105, 209.59.222.88, 210.135.96.98, 210.172.212.145, 210.193.54.122, 210.211.108.213, 210.211.108.215, 210.211.110.222, 211.154.145.72, 211.43.202.41, 211.60.155.2, 211.72.230.83, 212.113.137.225, 212.166.68.202, 212.170.205.179, 212.174.140.29, 212.181.127.229, 212.20.40.252, 212.225.213.253, 212.227.20.8, 212.235.107.137, 212.29.7.194, 212.32.204.254, 212.36.9.52, 212.36.9.59, 212.36.9.60, 212.40.37.118, 212.40.45.170, 212.48.121.72, 212.7.193.170, 212.73.124.12, 212.82.216.42, 212.95.58.190, 213.131.156.50, 213.131.156.51, 213.17.153.11, 213.186.58.148, 213.189.197.70, 213.193.246.34, 213.228.128.112, 213.239.154.12, 213.239.193.176, 213.249.68.98, 216.109.195.222, 216.152.78.163, 216.152.78.164, 216.152.78.165, 216.152.78.166, 216.152.78.167, 216.154.17.51, 216.176.100.240, 216.186.143.88, 216.193.223.223, 216.215.112.149, 216.218.237.34, 216.224.184.101, 216.224.186.52, 216.246.77.218, 216.52.143.239, 216.6.229.205, 216.86.158.143, 217.107.34.84, 217.115.200.20, 217.117.187.98, 217.12.215.170, 217.146.93.106, 217.146.93.107, 217.146.93.108, 217.146.93.109, 217.146.93.110, 217.160.169.17, 217.160.91.70, 217.17.33.10, 217.208.43.245, 217.21.43.220, 217.23.152.116, 217.29.87.254, 217.69.165.160, 218.61.10.188, 220.110.167.233, 220.81.195.40, 221.12.162.32, 221.143.43.201, 221.206.88.193, 221.251.65.182, 222.35.141.231, 222.66.139.203, 223.4.20.20, 223.4.88.247, 24.4.7.37, 31.11.43.105, 31.131.31.35, 31.170.106.44, 31.170.109.120, 31.170.161.76, 31.192.213.231, 31.200.240.133, 31.204.130.58, 31.210.155.52, 31.31.203.123, 37.220.3.50, 37.59.78.161, 37.59.95.129, 37.59.95.130, 38.99.68.43, 38.99.68.44, 38.99.68.45, 38.99.68.46, 38.99.68.47, 46.105.173.84, 46.105.96.154, 46.137.23.30, 46.137.61.145, 46.16.233.108, 46.163.116.57, 46.163.116.61, 46.165.193.136, 46.166.129.247, 46.166.129.253, 46.166.137.120, 46.166.141.107, 46.166.143.56, 46.166.145.113, 46.166.148.133, 46.166.150.111, 46.166.154.121, 46.166.155.175, 46.166.156.121, 46.166.162.101, 46.166.162.215, 46.182.121.167, 46.20.5.231, 46.214.145.230, 46.22.117.150, 46.228.199.62, 46.246.119.146, 46.246.119.212, 46.254.16.126, 46.28.65.40, 46.30.40.91, 46.4.124.12, 46.4.171.177, 46.4.235.115, 46.4.71.20, 46.45.190.57, 46.47.81.166, 46.59.82.14, 49.212.32.154, 49.212.76.89, 5.39.6.31, 50.112.120.66, 50.17.228.8, 50.18.108.100, 50.18.21.241, 50.19.227.63, 50.22.158.181, 50.23.82.35, 50.31.149.10, 50.56.113.75, 50.56.86.206, 50.7.12.186, 50.7.16.246, 50.7.225.170, 50.7.245.210, 50.97.215.130, 58.26.182.98, 59.106.14.111, 59.124.27.180, 59.53.91.167, 60.13.186.5, 60.199.114.84, 61.100.185.177, 61.197.235.106, 61.221.147.253, 61.244.48.34, 61.31.99.67, 62.109.0.5, 62.109.23.228, 62.122.246.165, 62.128.158.18, 62.133.211.174, 62.149.24.10, 62.181.89.18, 62.193.219.170, 62.244.55.234, 62.29.173.51, 63.210.18.146, 63.223.101.149, 63.245.216.214, 64.120.171.200, 64.124.180.220, 64.13.223.122, 64.13.226.128, 64.13.254.72, 64.15.77.71, 64.150.160.16, 64.150.164.56, 64.150.180.13, 64.151.111.140, 64.18.148.78, 64.191.21.211, 64.191.70.164, 64.202.107.109, 64.203.102.74, 64.31.0.226, 64.32.20.172, 64.32.20.207, 64.32.22.221, 64.32.27.135, 64.62.190.36, 64.62.194.43, 64.62.194.44, 64.69.77.107, 64.71.165.201, 64.85.162.200, 64.85.164.87, 64.85.166.5, 64.85.169.114, 64.85.169.116, 65.110.60.90, 65.19.178.15, 65.23.153.236, 65.23.153.98, 65.23.156.37, 65.23.157.127, 65.60.46.78, 65.98.64.85, 66.118.151.24, 66.147.244.234, 66.154.121.189, 66.154.121.231, 66.197.202.5, 66.198.80.67, 66.207.167.12, 66.220.13.242, 66.225.225.225, 66.225.225.66, 66.225.230.241, 66.23.226.163, 66.41.211.152, 67.159.60.27, 67.18.208.172, 67.20.115.196, 67.21.65.120, 67.210.170.140, 67.210.170.141, 67.210.170.169, 67.218.118.62, 67.220.66.111, 67.220.66.166, 67.220.66.167, 67.220.66.171, 67.220.66.172, 67.220.66.175, 67.220.66.178, 67.220.66.68, 67.220.72.130, 67.220.72.144, 67.220.73.107, 67.220.74.155, 67.228.114.35, 67.228.179.250, 67.43.226.18, 67.43.228.202, 67.43.228.238, 67.43.228.244, 67.43.229.136, 67.43.229.157, 67.43.232.178, 67.43.238.230, 68.127.145.208, 68.168.118.202, 68.169.37.118, 68.171.211.243, 68.68.20.147, 68.68.21.165, 68.68.21.166, 68.68.21.168, 68.68.21.169, 69.162.163.11, 69.162.167.91, 69.175.127.82, 69.180.141.144, 69.197.59.250, 69.197.63.181, 69.199.121.114, 69.42.211.120, 69.42.211.123, 69.42.211.84, 69.42.74.183, 69.43.161.150, 69.43.161.177, 69.61.21.117, 69.64.52.143, 69.64.52.243, 69.65.42.31, 69.90.157.245, 70.32.96.169, 70.38.16.129, 70.38.16.130, 70.38.16.131, 70.38.16.132, 70.38.61.21, 70.38.76.129, 70.38.76.131, 70.38.76.132, 70.38.76.133, 70.38.76.134, 70.84.35.216, 70.85.16.102, 70.85.237.252, 71.19.150.142, 72.10.160.10, 72.10.160.8, 72.10.162.42, 72.10.174.99, 72.20.13.13, 72.20.21.125, 72.20.23.124, 72.20.23.78, 72.20.27.204, 72.20.28.197, 72.20.28.205, 72.20.28.206, 72.20.28.236, 72.20.28.251, 72.20.30.5, 72.20.35.120, 72.20.35.148, 72.20.35.70, 72.20.38.106, 72.20.38.177, 72.20.38.180, 72.20.40.249, 72.232.72.220, 72.250.175.12, 72.55.165.149, 72.8.140.109, 72.8.140.126, 72.8.140.143, 72.8.140.151, 72.8.140.222, 72.8.140.84, 74.117.60.218, 74.122.123.234, 74.143.141.244, 74.208.101.128, 74.208.228.244, 74.208.70.55, 74.208.8.164, 74.221.208.242, 74.55.82.192, 75.119.201.232, 75.125.194.42, 75.125.194.43, 75.125.194.44, 75.125.194.45, 76.226.195.182, 76.73.15.38, 76.74.255.138, 76.76.11.208, 76.76.18.80, 77.109.111.66, 77.120.104.16, 77.222.40.167, 77.223.154.107, 77.223.156.216, 77.223.156.75, 77.232.82.24, 77.235.47.228, 77.37.142.27, 77.66.39.57, 77.79.11.36, 77.79.4.204, 77.79.4.206, 77.79.7.19, 77.88.144.29, 77.89.242.58, 77.91.231.193, 78.108.81.133, 78.110.173.202, 78.110.9.77, 78.129.133.16, 78.129.226.145, 78.129.239.80, 78.142.63.133, 78.159.108.43, 78.159.112.185, 78.189.218.14, 78.189.235.94, 78.24.188.201, 78.29.0.253, 78.31.71.67, 78.46.169.129, 78.46.169.131, 78.46.169.151, 78.46.169.152, 78.46.175.12, 78.46.95.197, 78.47.22.107, 78.70.90.83, 78.93.234.231, 79.125.119.53, 79.132.67.141, 79.96.195.67, 79.99.41.12, 8.225.195.155, 80.237.201.63, 80.243.182.61, 80.65.63.58, 80.67.3.116, 80.78.242.12, 80.82.65.99, 80.82.66.234, 80.83.124.227, 80.86.91.80, 80.92.69.86, 80.93.28.189, 80.93.57.195, 80.93.62.91, 80.94.68.71, 81.144.210.251, 81.168.86.141, 81.169.186.131, 81.18.129.4, 81.222.215.143, 81.222.215.236, 81.29.65.57, 82.127.76.142, 82.137.161.42, 82.179.217.4, 82.197.73.187, 82.197.73.188, 82.80.148.250, 83.136.48.15, 83.137.41.33, 83.140.172.210, 83.140.172.211, 83.140.172.212, 83.144.73.182, 83.149.70.129, 83.221.134.243, 83.243.46.2, 83.68.16.198, 84.201.7.15, 84.22.127.18, 84.27.119.230, 84.45.27.174, 85.13.141.156, 85.142.45.240, 85.153.55.68, 85.17.109.31, 85.17.159.77, 85.17.190.79, 85.17.213.154, 85.17.90.211, 85.21.79.12, 85.214.203.6, 85.214.233.147, 85.214.80.207, 85.236.110.226, 85.236.110.228, 85.24.148.100, 85.25.10.63, 85.25.100.223, 85.25.109.116, 85.25.110.141, 85.25.111.137, 85.25.17.177, 85.25.224.38, 85.25.248.206, 85.25.35.133, 85.31.187.144, 85.88.6.197, 86.104.210.230, 86.57.151.5, 87.118.124.140, 87.118.89.3, 87.237.63.246, 87.238.192.106, 87.238.192.83, 87.98.246.218, 88.147.128.15, 88.181.114.175, 88.190.26.141, 88.191.131.198, 88.191.134.36, 88.191.231.108, 88.191.66.7, 88.191.93.133, 88.198.16.80, 88.198.41.164, 88.216.91.104, 88.216.91.106, 88.216.91.120, 88.216.91.123, 88.216.91.98, 88.216.91.99, 88.255.116.47, 89.106.13.130, 89.108.121.142, 89.108.67.172, 89.108.67.176, 89.108.73.17, 89.110.146.5, 89.163.162.2, 89.163.177.99, 89.208.141.139, 89.208.149.205, 89.208.149.212, 89.208.34.119, 89.248.162.170, 89.248.172.196, 89.25.68.209, 89.253.247.168, 89.46.251.146, 89.46.251.158, 89.46.251.169, 91.121.102.50, 91.121.146.118, 91.121.171.64, 91.121.19.113, 91.121.196.98, 91.121.27.37, 91.121.6.41, 91.121.63.96, 91.121.67.157, 91.121.74.218, 91.121.80.165, 91.121.89.35, 91.187.117.215, 91.188.34.240, 91.192.195.152, 91.194.10.100, 91.194.40.70, 91.205.19.2, 91.205.74.11, 91.207.137.58, 91.207.15.112, 91.211.88.61, 91.213.217.36, 91.215.218.79, 91.217.82.143, 91.217.82.147, 91.218.38.244, 91.219.29.14, 91.220.163.12, 91.220.62.112, 91.220.62.190, 91.223.223.244, 91.223.89.201, 91.226.212.115, 91.227.16.17, 91.228.160.170, 91.228.160.201, 91.229.90.3, 91.231.126.32, 91.232.181.33, 92.114.200.165, 92.114.95.14, 92.241.163.40, 92.241.164.195, 92.241.177.35, 92.241.191.91, 92.243.23.21, 92.38.209.180, 92.38.232.91, 92.46.62.198, 92.61.32.19, 93.113.196.22, 93.186.195.74, 93.189.105.234, 93.63.230.222, 93.90.82.2, 94.125.182.253, 94.125.182.255, 94.136.52.28, 94.156.162.165, 94.199.51.54, 94.228.222.204, 94.23.10.157, 94.23.120.142, 94.23.13.5, 94.23.148.30, 94.23.157.150, 94.23.36.8, 94.23.36.82, 94.23.57.92, 94.46.127.1, 94.63.149.51, 94.73.195.3, 94.75.193.47, 94.75.193.48, 94.75.234.5, 94.75.255.88, 95.0.130.220, 95.163.88.209, 95.167.99.99, 95.168.178.88, 95.169.187.66, 95.169.190.41, 95.170.70.238, 95.211.133.81, 95.211.146.53, 95.211.154.159, 95.211.44.3, 96.126.105.224, 96.126.111.217, 96.126.97.107, 96.44.144.253, 96.8.121.126, 98.126.44.98 }

block in log (all) quick on $ext_if from <ET> to any